basic/BasicAuthProvider.java in AuthGuard before 0.9.0 allows authentication via an inactive identifier.