It is possible to have duplicate user_ids within a tenant for users in different connections. On a user's initial login, the ID and Access tokens returned will be for the expected user. However, during a refresh token exchange, there is a chance that the tokens returned will belong to the other user sharing that user_id, even if that connection is not enabled for the application the user is logging into. This article will explain how this can happen. 

• User Profile
• Refresh Tokens

During a refresh token exchange, Auth0 will return the first user_id it finds, regardless of the connection. So, within a single tenant, if User A in Connection A has the same user_id as User B in Connection B, there is a chance that the ID Token and Access tokens returned after a refresh token exchange for User A will actually have the data for User B. 

For regular and custom database connections, avoid creating duplicate user_ids within a tenant for different database connections.

Related References

• Identify Users