diff --git a/changelogs/server_server/newsfragments/2288.clarification b/changelogs/server_server/newsfragments/2288.clarification
new file mode 100644
index 00000000..3558f255
--- /dev/null
+++ b/changelogs/server_server/newsfragments/2288.clarification
@@ -0,0 +1 @@
+Specify that callers of `/_matrix/federation/v1/openid/userinfo` must validate the returned user ID.
diff --git a/data/api/server-server/openid.yaml b/data/api/server-server/openid.yaml
index ce7d8866..22b7f941 100644
--- a/data/api/server-server/openid.yaml
+++ b/data/api/server-server/openid.yaml
@@ -43,7 +43,12 @@ paths:
                 properties:
                   sub:
                     type: string
-                    description: The Matrix User ID who generated the token.
+                    description: |
+                      The Matrix User ID who generated the token.
+
+                      The caller MUST validate that the returned user ID is on the server they
+                      called (i.e. if you make a request to example.com and it returns
+                      `@alice:matrix.org`, the result is invalid).
                     example: "@alice:example.com"
                 required:
                   - sub