By default the SFDX CLI command sfdx force:auth:web:login will not work if you’re trying to login to a sandbox org. This will open up a window to login.salesforce.com . And as we know to login to a sandbox you need to go to test.salesforce.com.
Use the -r or --instanceurl flag with your command. This lets you specify the path of the login page you want to authorize from.
So you have sfdx force:auth:web:login -r https://test.salesforce.com