Strix pointed itself at n8n's token-exchange flow and found an identity-binding bug: two trusted issuers emitting the same sub map to the same local account. One trusted token could log you in as someone else.