diff --git a/application/Espo/Core/Utils/Authentication/Espo.php b/application/Espo/Core/Utils/Authentication/Espo.php
index <HASH>..<HASH> 100644
--- a/application/Espo/Core/Utils/Authentication/Espo.php
+++ b/application/Espo/Core/Utils/Authentication/Espo.php
@@ -53,6 +53,12 @@ class Espo extends Base
             ]
         ]);
 
+        if ($user && $authToken) {
+            if ($user->id !== $authToken->get('userId')) {
+                return null;
+            }
+        }
+
         return $user;
     }
 }
auth: do not allow another auth token if passwords are the same