Recreating the Auth0 Authorization extension rule fixed this for us.
Also, it looks like from the changelog (auth0-authorization-extension/CHANGELOG.md at master · auth0/auth0-authorization-extension · GitHub) that the sameSite changes are implemented in version 2.7, but i was only able to update to version 2.6.