If you are not using the otp feature, or you are using it but setting otp_drift nil or otp_drift 0 in your Rodauth configuration, there is no impact.

If you are using the otp feature with otp_drift enabled (the default is 30 if the otp feature is enabled), and an attacker gets access to a valid TOTP code that was already used, they can replay the code during the drift window and have it be accepted as valid. The drift window is 30 seconds by default, and Rodauth does not allow reuse of the code within 30 seconds by default, so assuming a roughly accurate clock, an attacker would have 0-30 seconds to replay the valid code starting 30 seconds after it was originally accepted as valid.