When an attacker gains access to someone else's account, often by exploiting a weak spot in how your app verifies who's who. It's the main danger of automatically merging accounts just because they share an email address.