> By injecting xauth commands one gains limited* read/write arbitrary files, information leakage or xauth-connect capabilities. These capabilities can be leveraged by an authenticated restricted user - e.g. one with the login shellconfigured as /bin/false or one with configured forced-commands - to bypass account restriction. This is generally not expected.

> The injected xauth commands are performed with the effective permissions of the logged in user as the sshd already dropped its privileges.

So basically setting the shell to /bin/false or something like that can be bypassed.

Just block users in sshd_config