diff --git a/web/pgadmin/__init__.py b/web/pgadmin/__init__.py
index f5e2c329d43..bec48f8a907 100644
--- a/web/pgadmin/__init__.py
+++ b/web/pgadmin/__init__.py
@@ -1004,11 +1004,12 @@ def before_request():
                 return response
         # if the server is restarted the in memory key will be lost
         # but the user session may still be active. Logout the user
-        # to get the key again when login
+        # to get the key again when login. auth_source_manager is None while
+        # an OAuth2 login is pending: treat it as an unknown source.
         if config.SERVER_MODE and current_user.is_authenticated and \
             'auth_source_manager' in session and \
-            session['auth_source_manager']['current_source'] not in \
-            [KERBEROS, OAUTH2, WEBSERVER] and \
+            (session['auth_source_manager'] or {}).get('current_source') \
+            not in [KERBEROS, OAUTH2, WEBSERVER] and \
                 current_app.keyManager.get() is None and \
                 request.endpoint not in ('security.login', 'security.logout'):
             logout_user()
diff --git a/web/pgadmin/authenticate/__init__.py b/web/pgadmin/authenticate/__init__.py
index 223963ae802..a03c7ff47f0 100644
--- a/web/pgadmin/authenticate/__init__.py
+++ b/web/pgadmin/authenticate/__init__.py
@@ -187,7 +187,10 @@ def _login():
         auth_obj = AuthSourceManager(form, copy.deepcopy(
             config.AUTHENTICATION_SOURCES))
 
-    session['auth_source_manager'] = None
+    # An authenticated user keeps their current source until the new login
+    # succeeds: every request reads it, and None would break them.
+    if not current_user.is_authenticated:
+        session['auth_source_manager'] = None
 
     # The internal account whose password Flask-Security checks: it is
     # looked up the same way, by email and ignoring case.