diff --git a/app/services/door.py b/app/services/door.py
index 453cc4e..5b36ea7 100644
--- a/app/services/door.py
+++ b/app/services/door.py
@@ -29,7 +29,7 @@ class DoorController:
         if not mock_factory:
             import paho.mqtt.client as mqtt
             self._mqtt = mqtt.Client(mqtt.CallbackAPIVersion.VERSION2)
-            self._mqtt.connect(mqtt_host, mqtt_port)
+            self._mqtt.connect(mqtt_host, mqtt_port) #TODO: add login with username+pw, tls
             self._mqtt.loop_start()
             logger.info("Mqtt client connect to %s:%s", mqtt_host, mqtt_port)
 
@@ -102,11 +102,13 @@ def checkAccess(key: str, db: Session):
         current_time = datetime.now()
         card = db.exec(select(Card).where(Card.key == key)).one()
         if not card.enabled:
+            logger.info("Card Inactive!")
             return False
         for auth in card.group.accessauths:
             logger.info(f"checking auth: {auth.name}")
             if not auth.is_active:
-                return False
+                logger.info("AA inactive!")
+                continue
             if auth.type == "timetable":
                 for timetable in auth.timetables:
                     logger.info(f"  checking timetable {timetable.id}")
diff --git a/test/test_services/test_door.py b/test/test_services/test_door.py
index 3fcc356..3a5d33d 100644
--- a/test/test_services/test_door.py
+++ b/test/test_services/test_door.py
@@ -173,4 +173,47 @@ def test_check_access_with_inactive_card(db_session):
 
     db_session.commit()
 
-    assert checkAccess("test-key-123", db_session) == False
\ No newline at end of file
+    assert checkAccess("test-key-123", db_session) == False
+
+def test_regression_check_access_issue_28(db_session):
+    # Having a active aa after a inactive/invalid one denies access
+    group = GroupDB(name="Test Group")
+    db_session.add(group)
+    db_session.commit()
+
+    card = Card(
+        key="test-key-123",
+        group_id=group.id,
+        enabled=True,
+        name="test_card",
+        card_serial="00:00:00:00:00:00:00",
+    )
+    db_session.add(card)
+
+    #Creating timetable with inactive AA
+    timetable1 = Timetable(
+        weekday=datetime.datetime.weekday(datetime.date.today()),
+        starttime=datetime.datetime.now().time(),
+        duration=120,  # 2 hours
+    )
+    db_session.add(timetable1)
+    aa1 = AccessAuthorizationDB(name="First AA", is_active=False, type="timetable")
+    db_session.add(aa1)
+    aa1.timetables = [timetable1]
+
+    #Creating timetable with active AA
+    timetable2 = Timetable(
+        weekday=datetime.datetime.weekday(datetime.date.today()),
+        starttime=datetime.datetime.now().time(),
+        duration=120,  # 2 hours
+    )
+    db_session.add(timetable2)
+    aa2 = AccessAuthorizationDB(name="Second AA", is_active=True, type="timetable")
+    db_session.add(aa2)
+    aa2.timetables = [timetable2]
+
+    group.accessauths = [aa1, aa2]
+
+    db_session.commit()
+
+    assert checkAccess("test-key-123", db_session) == True
\ No newline at end of file