The QR code would only contain a login challenge, the phone would complete the challenge. Of course that would mean the auth server must be publicly reachable or the phone must be in the same network.

As far as I understood, if somebody else scanned the same token, they would just login with their own account (if they have one).

Whoever logged in first would invalidate the hexhexhex token and the second person would need to start another browser session.