They don't have to be on the same server as long as you don't plan to use the "vB3 Enhanced" features of the script (those require access to the
vb global.php script). You can put them on seperate domains and share a common login as long as the other server can connect to the database on the other server (you have to check with your host to make sure they allow external connections).
One other thing, because you cannot share cookies across domains, while they share the same userid/password, they would still have to login twice (once on each site) as the login info is stored in seperate cookies (one for each domain).