diff --git a/Streetwriters.Identity/Validation/MFAGrantValidator.cs b/Streetwriters.Identity/Validation/MFAGrantValidator.cs
index 888b6b9..0f71bd7 100644
--- a/Streetwriters.Identity/Validation/MFAGrantValidator.cs
+++ b/Streetwriters.Identity/Validation/MFAGrantValidator.cs
@@ -75,8 +75,8 @@ namespace Streetwriters.Identity.Validation
             var tokenValidationResult = await TokenValidator.ValidateAccessTokenAsync(tokenResult.Token, Config.MFA_GRANT_TYPE_SCOPE);
             if (tokenValidationResult.IsError) return;
 
-            var client = Clients.FindClientById(tokenValidationResult.Claims.GetClaimValue("client_id"));
-            if (client == null)
+            var client = Clients.FindClientById(context.Request.ClientId);
+            if (client == null || context.Request.ClientId != tokenValidationResult.Claims.GetClaimValue("client_id"))
             {
                 context.Result = new GrantValidationResult(TokenRequestErrors.InvalidClient);
                 return;
diff --git a/Streetwriters.Identity/Validation/MFAPasswordGrantValidator.cs b/Streetwriters.Identity/Validation/MFAPasswordGrantValidator.cs
index 2b12fc6..391c457 100644
--- a/Streetwriters.Identity/Validation/MFAPasswordGrantValidator.cs
+++ b/Streetwriters.Identity/Validation/MFAPasswordGrantValidator.cs
@@ -63,13 +63,11 @@ namespace Streetwriters.Identity.Validation
             var tokenResult = BearerTokenValidator.ValidateAuthorizationHeader(httpContext);
             if (!tokenResult.TokenFound) return;
 
-
             var tokenValidationResult = await TokenValidator.ValidateAccessTokenAsync(tokenResult.Token, Config.MFA_PASSWORD_GRANT_TYPE_SCOPE);
             if (tokenValidationResult.IsError) return;
 
-
-            var client = Clients.FindClientById(tokenValidationResult.Claims.GetClaimValue("client_id"));
-            if (client == null)
+            var client = Clients.FindClientById(context.Request.ClientId);
+            if (client == null || context.Request.ClientId != tokenValidationResult.Claims.GetClaimValue("client_id"))
             {
                 context.Result = new GrantValidationResult(TokenRequestErrors.InvalidClient);
                 return;
@@ -80,16 +78,15 @@ namespace Streetwriters.Identity.Validation
 
             if (string.IsNullOrEmpty(userId)) return;
 
+            var user = await UserManager.FindByIdAsync(userId);
+            if (user == null) return;
+
             context.Result.Error = "unauthorized";
             context.Result.ErrorDescription = "Password is incorrect.";
 
             if (string.IsNullOrEmpty(password)) return;
 
-            var user = await UserManager.FindByIdAsync(userId);
-            if (user == null) return;
-
             var result = await SignInManager.CheckPasswordSignInAsync(user, password, true);
-
             if (result.IsLockedOut)
             {
                 var timeLeft = user.LockoutEnd - DateTimeOffset.Now;