A user with access to a valid SAML response may impersonate another user under specific conditions.
CWE-347