Not checking the "audience" of a token or misconfiguring it is pretty common. A lot of applications don't actually check it.