The problem occurs only when the login process happens in the app's embedded browser (also known as in-app browser). The launch.php script starts a session, creating a non-partitioned cookie (the cookie is created partitioned because the embedded browser User Agent contains MoodleMobile and we enforce partitioned cookies in these scenarios), while the rest of the process sets partitioned cookies once the user is authenticated. This leads to the user not being able to log in.

To address this issue, there are two options:

1. Avoid using partitioned cookies when authentication occurs via the embedded browser in the app.
2. Force the launch.php script to always use partitioned cookies.

Option 1 is not feasible as we don't have a way to distinguish whether the request is coming from an embedded browser or from an iframe within the app without adding a lot of code.
So we can only go for Option 2 that it will only require a very quick fix.

However, further investigation is needed to find a more robust solution to enforce the use of partitioned cookies consistently when using the embedded browser, regardless of the main entry point (such as login/index.php).