Solution:
Got it working with this in wp-config.php:
$allowed_domains = array(
'site.local',
'anothersite.local'
);
$cookie_domain = (in_array($_SERVER['SERVER_NAME'], $allowed_domains)) ? $_SERVER['SERVER_NAME'] : $allowed_domains[0];
define('COOKIE_DOMAIN', $cookie_domain);
It checks if the user’s domain is on the allowed domains list and adjust cookie domain on the fly to match it. It defaults to the first domain in the array if it doesn’t match.