ASVS-V10.5.3 The client rejects attempts by a malicious authorization server to impersonate another authorization server through authorization server…

Verify that the client rejects attempts by a malicious authorization server to impersonate another authorization server through authorization server metadata. The client must reject authorization server metadata if the issuer URL in the authorization server metadata does not exactly match the pre-configured issuer URL expected by the client.