Issuer confusion is the failure to distinguish correctly between identity issuers, tenants, or trust domains when validating authentication artifacts. It matters because tokens and federation messages are only trustworthy in the right issuer context, not in all contexts that look similar.
What is Issuer Confusion?
This can happen when applications undercheck issuer claims, reuse keys across contexts, or blur tenant boundaries. The result may be acceptance of tokens from the wrong identity provider, tenant, or environment.
What Issuer Confusion Commonly Supports
Common uses include federated identity hardening, multi-tenant API review, OIDC validation, and SSO trust modeling.
Issuer Confusion vs. Strict Issuer Boundary Validation
Issuer confusion mixes trust domains that should remain separate. Strict boundary validation ensures only the intended issuer is accepted for a given relying party.
Frequently Asked Questions
Why is issuer confusion dangerous?
Because it can let a real token from the wrong place act as if it belonged to the right place.
What commonly causes it?
Loose claim validation, shared configuration shortcuts, and weak tenant scoping are common contributors.
