I’m having the same exact issue, but no proposed fix works.
loadUserInfo does the trick, but loadUserProfile still gives a CORS problem, even if I give “Full Scope Allowed” to the account client.
The client I’m using for keycloak-js has the redirect uri and web origins all set correctly.