With a wildcard callback URL configured, login fails with this message in my browser console:
Cross-Origin Request Blocked: The Same Origin Policy disallows reading the remote resource at https://auth.inrange.dev/oauth2/token. (Reason: CORS header ‘Access-Control-Allow-Origin’ missing). Status code: 200.
Cross-Origin Request Blocked: The Same Origin Policy disallows reading the remote resource at https://auth.inrange.dev/oauth2/token. (Reason: CORS header ‘Access-Control-Allow-Origin’ missing). Status code: 200.