Same issue here. We have a custom universal login & MFA pages, if it’s any relevant.
So far, I’ve only heard reports of the issue happening on Safari mobile (iOS).
I think the solution is to ditch loginWithPopup and use loginWithRedirect instead, unfortunately.
My theory atm is that this may be due to privacy restrictions imposed by the browser which might interfere with the auth flow, but I can’t say for sure.
This issue has been reported many times in the past, but there hasn’t been a resolution to the underlying problem [1] [2] [3] [4]