A mismatched OAuth callback state no longer aborts login as a CSRF attack, it's just ignored now
When logging in and manually pasting an OAuth callback URL, if its state parameter doesn't match the login attempt currently in progress, Claude Code used to immediately abort the whole login flow with an error calling it a possible CSRF attack (a type of forged-request attack). Now it logs a quieter debug message saying the callback belongs to a different flow and simply ignores it, continuing to wait for the correct callback instead of throwing an error.
This avoids treating a mismatched callback, which can happen for benign reasons like multiple login attempts in flight, as a security attack that kills the whole login process. Login now continues waiting rather than failing outright in this situation.