This is a completely unacceptable vulnerability in any software purporting itself to be an identity provider. OP, name and shame this provider. I do not want to find myself using it.
Nice find! As for the provider, since they missed this extremely basic step (don't trust the client!!) I would expect they have <i>many</i> more undiscovered vulnerabilities.
This is honestly the kind of mistake I'd expect a child to make. It shows a complete lack of understanding of how the web works. And this was put into production by a so-called security company? I think a name and shame is appropriate here. This isn't excusable, it's just straight up incompetence.