diff --git a/src/service/oauth/mod.rs b/src/service/oauth/mod.rs
index 8bf3b0e75..c3db66a57 100644
--- a/src/service/oauth/mod.rs
+++ b/src/service/oauth/mod.rs
@@ -586,6 +586,16 @@ async fn create_session(
 				));
 			};
 
+			if session_info.client_id != client_id {
+				// This device was created by a different piece of client
+				// software. Either the client stepping up
+				// changed its registration without logging out
+				// or someone is screwing with things.
+				return Err(OAuthError::invalid_grant(
+					"The supplied device was created by a different client",
+				));
+			}
+
 			session_info.temporary_scopes = requested_scopes.scopes;
 
 			self.services