Windows desktop login fails because OAuth callback ports are reserved by Windows

What version of the Codex App are you using (From “About Codex” dialog)?

26.901.41600

What subscription do you have?

At the moment Plus, but it was the same with Pro x5

What platform is your computer?

No response

What issue are you seeing?

I can't sign in with my ChatGPT account in the Windows desktop app. It fails with:

Sign-in failed: failed to start login server: Port 127.0.0.1:1457 is already in use

No process is listening on ports 1455 or 1457. However, both ports are inside Windows' excluded TCP range 1438–1537.

Native PowerShell CLI login also fails (not for the device code though). I have WSL 2 installed with mirrored networking enabled, but the desktop app is running on Windows.

What steps can reproduce the bug?

1. Open the Windows desktop app.
2. Select the option to sign in with ChatGPT.
3. Login fails with the error above.

What is the expected behavior?

ChatGPT sign-in should work when Windows has reserved the callback ports. If those ports are unavailable, the desktop app should offer another way to sign in or explain how to resolve it.

Additional information

This PowerShell command returned no listeners:

Get-NetTCPConnection -State Listen -LocalPort 1455,1457 -ErrorAction SilentlyContinue |
    Select-Object LocalAddress,LocalPort,OwningProcess

This command showed an excluded range covering both ports:

netsh interface ipv4 show excludedportrange protocol=tcp

Relevant output:

Startport    Endport
1438         1537

I was able to sign in by stopping WinNAT in an Administrator PowerShell:

net stop winnat

I then completed ChatGPT sign-in in the Windows desktop app and restarted the service:

net start winnat

This worked around the login failure, but required manually stopping a Windows service.

Related reports:

• #40344 describes excluded callback ports blocking ChatGPT login in the Windows VS Code extension.
• https://github.com/openai/codex/issues/39846#issuecomment-5393273816 describes a login-server error in the Windows desktop app, but with error 10013 instead.

Reproduce the Windows desktop OAuth callback failure with ports 1455 and 1457, using the reported PowerShell listener and excluded-port commands; compare the related reports #40344 and #39846. Trace the desktop login-server entry point and verify completion by signing in while the callback ports are reserved, without manually stopping WinNAT.