We have an OAuth Web Server Flow setup in our SF managed package that is used to authenticate our web service with Salesforce for API access. When a user first opens our app in SF, a call is first made to the /services/oauth2/authorize endpoint with the client's Org ID and our client details. Salesforce then normally redirects the user to their remote access authorization page, asking the user to grant our app permission to access their org.
It seems that for a small few of our clients that are attempting to use our app within a sandbox, they get redirected to the Salesforce login page at test.salesforce.com, and entering their credentials simply logs them into Salesforce. Our callback URL is never sent the appropriate auth code.
It occurs somewhat rarely, as some sandboxes authorize without any issues.
Anyone have any ideas on how to diagnose this, or what might be happening?