In OpenID Connect the issuer is an HTTPS URL that must match the issuer in the provider's discovery document exactly, including any trailing path; the verifier fetches jwks_uri from that document. Multi-tenant providers (for example Microsoft Entra ID) put the tenant in the issuer, so accepting "any issuer from this provider" without checking it lets tokens from other tenants in.
The rule is to tie keys to issuers: a key from issuer A's JWKS must not validate a token that claims issuer B (RFC 8725 §3.8). The mix-up attack in OAuth, where a client confuses which authorization server responded, is countered by the iss authorization response parameter (RFC 9207).