When validating an ID token, 
you should verify that the aud (Audience) 
claim equals the Client ID of the current application.

Add this to the validation parameters:
ValidateAudience = true,
ValidAudience = "xyz123", // This Application's Client ID