We’re seeing this same exception. I can reliably reproduce it by starting the auth flow in Firefox, switching to Chrome to finish it. This makes sense, since chrome does not have the correct state token. The problem for us is that it happens intermittently using the same browser/tab/session all the way through.
@jmangelo I have an open support ticket with a ton more detail if you’re able to take a look. It does contain some sensitive things (pieces of our code). I can scrub it and post it here if that’s useful.