[macOS][Codex App] OAuth callback can be applied to the wrong concurrent session

What version of the Codex App are you using (From “About Codex” dialog)?

26.814.41407 (6720)

What subscription do you have?

Plus

What platform is your computer?

Darwin 25.3.0 arm64 arm

What issue are you seeing?

When two Codex tasks/sessions initiate OAuth authorization flows concurrently, completing the flow initiated by Session A can apply the authorization result to Session B.

The OAuth callback succeeds, but the connection state appears in the wrong Codex session. The session that originally initiated the authorization can remain pending or display an incorrect connection state.

This suggests that pending OAuth authorization state or callback routing may not be fully isolated per Codex session.

This report concerns separate sessions in the same local Codex App. I have not confirmed any cross-account exposure.

What steps can reproduce the bug?

1. Open two independent Codex tasks/sessions: Session A and Session B.
2. In Session A, initiate an OAuth authorization flow.
3. Before completing it in the browser, switch to Session B.
4. Initiate another OAuth authorization flow from Session B.
5. Complete the browser authorization originally initiated by Session A.
6. Return to the Codex App.
7. Observe that the successful connection can be associated with Session B instead of Session A.

The issue has been observed when OAuth flows are active concurrently.

What is the expected behavior?

Each OAuth authorization flow should remain bound to the Codex session that initiated it.

The callback should be matched using its unique OAuth state value and should update only the corresponding session. Starting another OAuth flow from a different session must not overwrite or replace the first session's pending authorization state.

If concurrent OAuth flows are not supported, the app should reject the second flow with a clear message instead of routing the callback to the wrong session.

Additional information

Related to #12263, but distinct.

Issue #12263 concerns the VS Code extension on Windows/WSL, where multiple instances can cause localhost callback failures, timeouts, or an OAuth State mismatch.

In this macOS Codex App case, the callback does not merely fail with a state mismatch: it succeeds, but the authorization result can be associated with the wrong active Codex session.

Potential impact:

• Incorrect connection status between concurrent sessions.
• One session receiving another session's OAuth result.
• Confusing or unreliable concurrent authentication flows.
• A possible session-isolation issue within the same local user account.

No access tokens, authorization codes, cookies, OAuth URLs containing credentials, account identifiers, or other sensitive information are included in this public report.