I figured it out!
I had declared a custom “Rule” in the beginning and completely forgot about it. Once I deleted it everything worked fine.
Turns out my rule applied to all my authorization requests and prevented Auth0 from sending back the User object. Thats why I actually logged in correctly, but my React App expected a the users profile back. But because it never arrived it was stuck in the loading state.