diff --git a/cmd/kubectl_token_oauth.go b/cmd/kubectl_token_oauth.go
index 6c5e6d05..329e12f7 100644
--- a/cmd/kubectl_token_oauth.go
+++ b/cmd/kubectl_token_oauth.go
@@ -52,7 +52,7 @@ func oauthAuth(client *http.Client, input *LoginInput, provider TypedProvider, u
 func getCallbackPort() (int, error) {
 	env := os.Getenv("CATTLE_OAUTH_CALLBACK_PORT")
 	if env == "" {
-		return 0, nil // Use random port
+		return 8888, nil // Default port
 	}
 
 	port, err := strconv.Atoi(env)
@@ -199,8 +199,10 @@ func openBrowser(openURL string) error {
 		cmd = "xdg-open"
 		args = []string{openURL}
 	case "windows":
-		cmd = "cmd"
-		args = []string{"/c", "start", "", openURL}
+		// rundll32 handles the URL as a single argument; avoids cmd.exe
+		// interpreting `&` in query strings as a command separator.
+		cmd = "rundll32"
+		args = []string{"url.dll,FileProtocolHandler", openURL}
 	default:
 		return fmt.Errorf("unsupported platform: %s", runtime.GOOS)
 	}