In line 68 on the LoginController.php
$user = UserAlias::where('user_snowflake', $result->id)->first();
this line does not check for matching site and can allow users to login to other accounts if the snowflakes match
we have had this occur on production on another site