Hi, I noticed a weird case when I was experimenting with getting an access token using the password grant flow. Basically I setup an application/client to allow the password grant auth flow and I was able to successfully retrieve a token from the token endpoint, https://tenant-one.eu.auth0.com/oau…

This is a known issue. It has been reviewed by our Security team and found not to have any security implications. In the Password Grant flow, the /oauth/token endpoint will determine the client using the client_ID. Note that the host parameter does not play a role in this process. Note also tha…

Cross domain authentication using the password grant flow

Get Help

Topic		Replies	Views
Multiple tenant password grant being granted when it shouldn't be Get Help password-grant	2	3806	March 2, 2018
Tenants are not isolated by domain (URL)? Get Help url , tenant , domains	3	4914	February 9, 2019
Auth0 client can authenticate to another tenant?? Get Help jwt , auth0 , login , access-token	1	4502	June 3, 2020
Multi-tenant application and session sharing Get Help multi-tenant	2	4285	September 6, 2018
Getting new access token based on old access toke for different client id Get Help token , auth0 , access-token	2	3726	February 3, 2019

Cross domain authentication using the password grant flow

Related topics