Thanks Lane Duncan, I will try to reproduce this ASAP.

It's possible the bug is only in the error handling itself, as in such a case I would expect the nonce on XWiki side to be lost (since it's stored in the session), not to be different from the one sent back by the provider as suggested by the error.