Design/Logic Flaw

In zulip before 1.3.12, deactivated users could access messages if SSO was enabled...