diff --git a/connector/src/main/java/org/geysermc/connector/network/session/GeyserSession.java b/connector/src/main/java/org/geysermc/connector/network/session/GeyserSession.java
index 884134948..b7ca7a2f5 100644
--- a/connector/src/main/java/org/geysermc/connector/network/session/GeyserSession.java
+++ b/connector/src/main/java/org/geysermc/connector/network/session/GeyserSession.java
@@ -158,8 +158,12 @@ public class GeyserSession implements PlayerSession, Player {
     public void disconnect(String reason) {
         if (!closed) {
             loggedIn = false;
-            downstream.getSession().disconnect(reason);
-            upstream.disconnect(reason);
+            if (downstream != null && downstream.getSession() != null) {
+                downstream.getSession().disconnect(reason);
+            }
+            if (upstream != null) {
+                upstream.disconnect(reason);
+            }
         }
     }
 
diff --git a/connector/src/main/java/org/geysermc/connector/utils/LoginEncryptionUtils.java b/connector/src/main/java/org/geysermc/connector/utils/LoginEncryptionUtils.java
index 48e5d5150..54ab46135 100644
--- a/connector/src/main/java/org/geysermc/connector/utils/LoginEncryptionUtils.java
+++ b/connector/src/main/java/org/geysermc/connector/utils/LoginEncryptionUtils.java
@@ -150,10 +150,13 @@ public class LoginEncryptionUtils {
                     return false;
 
                 CustomFormResponse response = (CustomFormResponse) customFormWindow.getResponse();
-                String email = response.getInputResponses().get(2);
-                String password = response.getInputResponses().get(3);
 
-                session.authenticate(email, password);
+                if (response != null) {
+                    String email = response.getInputResponses().get(2);
+                    String password = response.getInputResponses().get(3);
+
+                    session.authenticate(email, password);
+                }
 
                 // TODO should we clear the window cache in all cases or just if not already logged in?
                 // Clear windows so authentication data isn't accidentally cached