diff --git a/src/auth.c b/src/auth.c
index 1e92fe12..9aecc0af 100644
--- a/src/auth.c
+++ b/src/auth.c
@@ -2520,6 +2520,7 @@ int ssh_userauth_gssapi_keyex(ssh_session session)
     session->auth.state = SSH_AUTH_STATE_NONE;
     session->pending_call_state = SSH_PENDING_CALL_AUTH_GSSAPI_KEYEX;
 
+    SAFE_FREE(session->gssapi->user);
     session->gssapi->user = strdup(session->opts.username);
     if (session->gssapi->user == NULL) {
         ssh_set_error_oom(session);
diff --git a/src/messages.c b/src/messages.c
index 5372c612..bebd4434 100644
--- a/src/messages.c
+++ b/src/messages.c
@@ -1177,6 +1177,7 @@ SSH_PACKET_CALLBACK(ssh_packet_userauth_request)
         received_mic.length = ssh_string_len(mic_token_string);
         received_mic.value = ssh_string_data(mic_token_string);
 
+        SAFE_FREE(session->gssapi->user);
         session->gssapi->user = strdup(msg->auth_request.username);
         buf = ssh_gssapi_build_mic(session, "gssapi-keyex");
         if (buf == NULL) {