It can be used by an attacker with access to cookies to determine the username of the last person who logged into that site using that browser. It can also possibly reveal a person's other account if they have multiple of them and were previously logged in using the other one and did not clear their cookies (which to be fair isn't necessary assuming they trust the site and expect logging out to fully log them out and not leave references to their account in cookies).
I am not sure why the server needs that information nor how is it used but there may be a vulnerability where the server blindly trusts the value and allows some kind of access based on it. In that case an attacker could set the cookie to anything they want and impersonate the corresponding user.
How to avoid it? Not set the value in the first place - again I am not sure what purpose it could serve, but if you truly do need such a value, keep it in the server's session instead. The client will not be able to see nor tamper with the value that way.