Missing Authorization Checks

matrix_synapse is vulnerable to Improper Authentication. The vulnerability is due to the _complete_login function as It fails to verify the deactivated status of users during login. This only applies if any of the following are true: 1. JSON Web Tokens are enabled for login via the jwt_config.enabled configuration setting. 2. The local password database is enabled via the password_config.enabled and password_config.localdb_enabled configuration settings and a user’s password is updated via an admin API after a user is deactivated.