diff --git a/org.adempiere.ui.zk/WEB-INF/src/org/adempiere/webui/util/BrowserToken.java b/org.adempiere.ui.zk/WEB-INF/src/org/adempiere/webui/util/BrowserToken.java
index 0bded89acc..6342e697e8 100644
--- a/org.adempiere.ui.zk/WEB-INF/src/org/adempiere/webui/util/BrowserToken.java
+++ b/org.adempiere.ui.zk/WEB-INF/src/org/adempiere/webui/util/BrowserToken.java
@@ -125,7 +125,8 @@ public final class BrowserToken {
 		MessageDigest digest = MessageDigest.getInstance("SHA-512");
 		Base64 encoder = new Base64();
 	    digest.reset();
-	    digest.update(session.getWebSession().getBytes("UTF-8"));
+	    if (session.getWebSession() != null)
+	    	digest.update(session.getWebSession().getBytes("UTF-8"));
 	    String password = null;
 	    if (MSystem.isZKRememberPasswordAllowed())
 	    	password = user.getPassword();