Popup login flow (MSAL 2.0) not working for certain users

Question

I'm developing an App Service JS app using Nuxt, and have implemented an OAuth login flow using MSAL 2.0 following the suggested vanilla JS examples (e.g. https://github.com/Azure-Samples/ms-identity-javascript-v2). This works fine in local testing, and similarly for myself upon deployment, but when another user tries it, the popup flow consistently fails. The login popup opens, they log in, and then it redirects back to the unauthenticated app in the popup, rather than the popup completing the auth flow and closing. I'm at a loss as to how to pick apart what's going on here – I've seen various other posts noting the presence of race conditions in some cases, or redirect logic stripping the auth hash from the URL (e.g. https://stackoverflow.com/questions/73005372/msal-all-tenants-sign-on-with-pop-up-redirects-inside-popup, https://stackoverflow.com/questions/67998252/why-does-msal-angular-loginpopup-pop-ups-its-own-page-when-i-am-using-azure-s/74720188#74720188) – I've tried to account for those cases, but it's not affected the behaviour at all.

An added element to the mystery: the app is mapped to a custom domain, and the user experiencing issues sees that the app is redirecting them to *