This CVE reveals a structural failure in how authentication systems handle conflicting administrative intent and automated state transitions. The core issue isn't simply that OAuth2 reactivates deactivated accounts — it's that this behavior survived an attempted fix, suggesting the original patch was surgically applied to a specific code path without solving the underlying architectural problem of who controls account lifecycle state.
The vulnerability exists because somewhere in the codebase, 'successful OAuth handshake' is treated as a sufficient condition to set account.active = true. That's a leaky abstraction: authentication should be stateless with respect to account lifecycle, deriving permissions from a pre-existing account record rather than modifying it. The auth layer treats account state as derived from successful authentication, while the admin layer treats it as an independent security control. When they disagree, the auth layer wins because it's closer to the login action.
The OAuth 2.0 specification doesn't mandate how an authorization server should behave when an administrator deactivates an account mid-session. RFC 6749 defines token issuance and refresh flows but is silent on the interaction between external account state management and authentication. This gap means every OAuth2 implementation makes an implicit decision about which system owns account state priority, and most make that decision by default behavior rather than explicit design.
The fix isn't adding guards to specific OAuth2 branches — it's removing the write operation entirely and treating OAuth success as a read-only assertion that 'this account, if it exists and is active, permits this authentication method.' Account status shouldn't be writable by authentication flows at all; it's a management plane concern, not an auth plane concern. You should audit all authentication pathways to confirm they treat account state as read-only, and ensure any new OAuth2 variant or auth source type undergoes security review that explicitly addresses what happens when admin state and auth state disagree — and who wins that argument.