Incorrect Authentication Leading To Impersonation

Search Guard Kibana Plugin is susceptible to incorrect authentication. It is possible for a Kibana user to impersonate as kibanaserver user by submitting incorrect credentials and by fulfilling following conditions: 1) Kibana is configured to use Single-Sign-On as authentication method, one of Kerberos, JWT, Proxy, Client certificate; 2) The kibanaserver user is configured to use HTTP Basic as the authentication method; and 3) Search Guard is configured to use an SSO authentication domain and HTTP Basic at the same time.