From 4d7341c32db8a9978821bfe7940229dd2ca1d5ec Mon Sep 17 00:00:00 2001
From: Ginger <ginger@gingershaped.computer>
Date: Mon, 5 Oct 2026 10:08:23 -0400
Subject: [PATCH] fix: Check for client ID mismatch in step-up auth

---
 src/service/oauth/mod.rs | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/src/service/oauth/mod.rs b/src/service/oauth/mod.rs
index 8bf3b0e75..c3db66a57 100644
--- a/src/service/oauth/mod.rs
+++ b/src/service/oauth/mod.rs
@@ -586,6 +586,16 @@ async fn create_session(
 				));
 			};
 
+			if session_info.client_id != client_id {
+				// This device was created by a different piece of client
+				// software. Either the client stepping up
+				// changed its registration without logging out
+				// or someone is screwing with things.
+				return Err(OAuthError::invalid_grant(
+					"The supplied device was created by a different client",
+				));
+			}
+
 			session_info.temporary_scopes = requested_scopes.scopes;
 
 			self.services