Sure, you can access accounts via SAML that don't have SAML permissions turned on, potentially letting me spoof myself as any user I'd want it to be, but that's defintely not a defect according to the tier 1 script reader I'm stuck talking to. 🙂