diff --git a/addons/auth_oauth/controllers/main.py b/addons/auth_oauth/controllers/main.py
index 3c3ddf84559..46d37d3cbb0 100644
--- a/addons/auth_oauth/controllers/main.py
+++ b/addons/auth_oauth/controllers/main.py
@@ -133,6 +133,8 @@ class OAuthController(http.Controller):
     def signin(self, **kw):
         state = json.loads(kw['state'])
         dbname = state['d']
+        if not http.db_filter([dbname]):
+            return BadRequest()
         provider = state['p']
         context = state.get('c', {})
         registry = RegistryManager.get(dbname)
@@ -182,6 +184,8 @@ class OAuthController(http.Controller):
             dbname = db_monodb()
         if not dbname:
             return BadRequest()
+        if not http.db_filter([dbname]):
+            return BadRequest()
 
         registry = RegistryManager.get(dbname)
         with registry.cursor() as cr: