Auth0 client can authenticate to another tenant?

[ieuan.jenkins]

Sounds like the same issue we’ve encountered here:

Auth0 not respecting multi-tenancy

Our organisation has two tenants. staging-tenant.eu.auth0.com prod-tenant.eu.auth0.com We are using this to run M2M client credential authentication. In each respective tenant, we have created the relevant M2M apps. For this example, app1 exists in staging-tenant.eu@auth0.com. If I send a token request with the app1 credentials to the prod tenant I get a valid jwt back. curl --request POST \ --url https://prod-tenant.eu.auth0.com \ --header 'content-type: application/json' \ --data '{…