Specific SAML refusal reasons leak organization and account state. Still redirect to the shared auth error page, but always use authentication_failed while logging the real cause server-side. Signed-off-by: Cursor Agent <cursoragent@cursor.com> Co-authored-by: Bryan FRIMIN <bryan@frimin.fr>