# Accessing apps protected via ZT's Access when user account is deleted/disabled even after clearing user session/seat

Deleted/disabled IdP user with preserved Access JWT metadata plus a second active account could reach SaaS apps lacking server-side validation.

- Payout: hidden
- Severity: high
- Program: Cloudflare Public Bug Bounty
- Found by: matured_kazama
- Disclosed: 2023-10-25
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/2122690
- Library page: https://bugbountylibrary.com/r/h1%3A2122690
- Tags: area:cloud domain:cloud impact:internal-access impact:privesc kind:bounty platform:hackerone sev:high tech:jwt vuln:access-control vuln:auth-bypass

**Target:** Cloudflare Access JWT authentication / SaaS app authorization
**Root cause:** Server-side validation of certain checks on the Access JWT was missing, so a deleted/disabled user's preserved JWT metadata combined with another active account in the same org bypassed authorization.
**Steps:**
1. User A is deleted/disabled at the IdP but preserved metadata of their Access JWT.
2. User A also controls another active account in the same organization.
3. Craft a request to a SaaS app protected by Access combining the preserved JWT metadata with the active account.
4. Because server-side validation of certain checks is absent, Access grants entry to apps the active account is not privileged for.
**Exploitation:** Attacker with a preserved Access JWT metadata fragment and a second active org account replays/combines them against Access-protected SaaS apps to gain unauthorized entry despite lacking privilege.
**Insight:** When an IdP deprovisions a user, test whether Access still honors residual JWT claims when paired with a second live account in the same org — deprovisioning must invalidate tokens server-side, not just at the IdP.