diff --git a/src/simutrans/network/network_cmd_ingame.cc b/src/simutrans/network/network_cmd_ingame.cc
index 6a098d1bf..fccb21e41 100644
--- a/src/simutrans/network/network_cmd_ingame.cc
+++ b/src/simutrans/network/network_cmd_ingame.cc
@@ -614,24 +614,26 @@ bool nwc_auth_player_t::execute(karte_t *welt)
 
 			// player activated for this client? or admin connection via nettool?
 			socket_info_t &info = socket_list_t::get_client(our_client_id);
+			// `player_nr` is wire-controlled; the slot may be NULL.
+			player_t *player = welt->get_player(player_nr);
 			if (info.is_player_unlocked(player_nr)  ||  info.state == socket_info_t::admin) {
 				DBG_MESSAGE("nwc_auth_player_t::execute","set pwd for plnr = %d", player_nr);
 
 				// change password
-				if (welt->get_player(player_nr)->access_password_hash() != hash) {
-					welt->get_player(player_nr)->access_password_hash() = hash;
+				if (player  &&  player->access_password_hash() != hash) {
+					player->access_password_hash() = hash;
 					// unlock all clients if new password is empty
 					// otherwise lock all
 					socket_list_t::unlock_player_all(player_nr, hash.empty(), our_client_id);
 				}
 			}
-			else if (player_nr < PLAYER_UNOWNED) {
+			else if (player_nr < PLAYER_UNOWNED  &&  player) {
 				// players with public service player access always pass password checks
 				if(  info.is_player_unlocked(1)  ) {
 					info.unlock_player(player_nr);
 				}
 				// check password
-				else if (welt->get_player(player_nr)->access_password_hash() == hash) {
+				else if (player->access_password_hash() == hash) {
 
 					DBG_MESSAGE("nwc_auth_player_t::execute","unlock plnr = %d at our_client_id = %d", player_nr, our_client_id);
 
@@ -642,7 +644,9 @@ bool nwc_auth_player_t::execute(karte_t *welt)
 			// report back to client who sent the command
 			if (our_client_id == 0) {
 				// unlock player on the server and clear unlock_pending flag
-				welt->get_player(player_nr)->unlock(info.is_player_unlocked(player_nr), false);
+				if (player) {
+					player->unlock(info.is_player_unlocked(player_nr), false);
+				}
 			}
 			else {
 				// send unlock-info to player on the client (to clear unlock_pending flag)