I encountered the exact same problem, and was able to fix it by including this in the Allowed Origins (CORS) configuration in my auth0 app:
capacitor://localhost