diff --git a/packages/twenty-server/src/engine/core-modules/auth/guards/oidc-auth.guard.ts b/packages/twenty-server/src/engine/core-modules/auth/guards/oidc-auth.guard.ts
index a8ae21133e1..1048b02b3b2 100644
--- a/packages/twenty-server/src/engine/core-modules/auth/guards/oidc-auth.guard.ts
+++ b/packages/twenty-server/src/engine/core-modules/auth/guards/oidc-auth.guard.ts
@@ -49,7 +49,10 @@ export class OIDCAuthGuard extends AuthGuard('openidconnect') {
       };
     }
 
-    throw new Error('Invalid OIDC identity provider params');
+    throw new AuthException(
+      'Invalid OIDC identity provider params',
+      AuthExceptionCode.INVALID_DATA,
+    );
   }
 
   async canActivate(context: ExecutionContext): Promise<boolean> {
diff --git a/packages/twenty-server/src/engine/core-modules/auth/guards/oidc-auth.spec.ts b/packages/twenty-server/src/engine/core-modules/auth/guards/oidc-auth.spec.ts
index 7cef1ef262d..46a16631a97 100644
--- a/packages/twenty-server/src/engine/core-modules/auth/guards/oidc-auth.spec.ts
+++ b/packages/twenty-server/src/engine/core-modules/auth/guards/oidc-auth.spec.ts
@@ -135,4 +135,24 @@ describe('OIDCAuthGuard', () => {
     await expect(guard.canActivate(mockExecutionContext)).resolves.toBe(false);
     expect(guardRedirectService.dispatchErrorFromGuard).toHaveBeenCalled();
   });
+
+  it('should handle missing state param and identityProviderId with AuthException', async () => {
+    const mockedRequest = createMockedRequest({}, {});
+
+    mockExecutionContext = createMockExecutionContext(mockedRequest);
+
+    await expect(guard.canActivate(mockExecutionContext)).resolves.toBe(false);
+    expect(guardRedirectService.dispatchErrorFromGuard).toHaveBeenCalled();
+    expect(ssoService.findSSOIdentityProviderById).not.toHaveBeenCalled();
+  });
+
+  it('should handle malformed state param with AuthException', async () => {
+    const mockedRequest = createMockedRequest({}, { state: 'not-json' });
+
+    mockExecutionContext = createMockExecutionContext(mockedRequest);
+
+    await expect(guard.canActivate(mockExecutionContext)).resolves.toBe(false);
+    expect(guardRedirectService.dispatchErrorFromGuard).toHaveBeenCalled();
+    expect(ssoService.findSSOIdentityProviderById).not.toHaveBeenCalled();
+  });
 });