- Shipped
- April 29, 2026 at 10:20 PM UTC
- Author
- Kamo
- Commit
- 6b4a436
auto-login accepted any *** and minted an OTK pointing back at it, regardless of which org the destination internal.* host belongs to. A stale or cross-org *** cookie surfaced at login.<host> would have been propagated into that host's internal subdomain, producing the "my session is for the wrong org" symptom. Resolve the current host's apex domain to its org via /api/security/org/domain and require the session's orgID to match before issuing the OTK. Fail-open on resolver errors to preserve current behavior when SecurityService is unreachable.