diff --git a/C4/SIP/SIPServer.pm b/C4/SIP/SIPServer.pm
index 0939478349..515342bbf8 100644
--- a/C4/SIP/SIPServer.pm
+++ b/C4/SIP/SIPServer.pm
@@ -269,6 +269,7 @@ sub process_request {
     Koha::Caches->flush_L1_caches();
 
     $self->{account} = undef;    # Clear out the account from the last request, it may be different
+    $self->{ils}     = undef;    # And the ILS handle, so a reused worker can't reuse a prior session's connection
     $self->{logger}  = set_logger( Koha::Logger->get( { interface => 'sip' } ) );
 
     # Flush previous MDCs to prevent accidentally leaking incorrect MDC-entries
@@ -468,12 +469,12 @@ sub telnet_transport {
             $pwd = get_clean_string($pwd);
             siplog( "LOG_DEBUG", "telnet_transport 2: uid length %s, pwd length %s", length($uid), length($pwd) );
 
-            # Check if user is authorized for SIP access, then authenticate via login_core
-            if ( exists( $config->{accounts}->{$uid} ) ) {
+            # Only log the terminal in once login_core actually authenticates it
+            if ( exists( $config->{accounts}->{$uid} )
+                && C4::SIP::Sip::MsgType::login_core( $self, $uid, $pwd ) )
+            {
                 $account = $config->{accounts}->{$uid};
-                if ( C4::SIP::Sip::MsgType::login_core( $self, $uid, $pwd ) ) {
-                    last;
-                }
+                last;
             }
             siplog( "LOG_WARNING", "Invalid login attempt: '%s'", ( $uid || '' ) );
             print("Invalid login$CRLF");
diff --git a/C4/SIP/Sip/MsgType.pm b/C4/SIP/Sip/MsgType.pm
index 2d8ddaf124..686734f330 100644
--- a/C4/SIP/Sip/MsgType.pm
+++ b/C4/SIP/Sip/MsgType.pm
@@ -934,13 +934,8 @@ sub login_core {
         return 0;
     }
 
-    # Store the active account configuration
-    $server->{account} = $server->{config}->{accounts}->{$uid};
-    my $inst = $server->{account}->{institution};
-    $server->{institution}  = $server->{config}->{institutions}->{$inst};
-    $server->{policy}       = $server->{institution}->{policy};
-    $server->{sip_username} = $uid;
-    $server->{sip_password} = $pwd;
+    # Authenticate before storing the account on the session
+    my $inst = $server->{config}->{accounts}->{$uid}->{institution};
 
     # Authenticate using Koha's internal authentication (checks hashed password in borrowers table)
     my $auth_status = api_auth( $uid, $pwd, $inst );
@@ -949,9 +944,20 @@ sub login_core {
             "LOG_WARNING", "Authentication failed for SIP terminal '%s' of '%s': %s",
             $uid,          $inst, ( $auth_status || 'unknown' )
         );
+
+        # Clear any session state, including anything left over from a previous connection on
+        # this preforked worker, so the caller can't act as an authenticated terminal
+        delete $server->{$_} foreach qw( account ils institution policy sip_username sip_password );
         return 0;
     }
 
+    # Store the active account configuration now user has authenticated
+    $server->{account}      = $server->{config}->{accounts}->{$uid};
+    $server->{institution}  = $server->{config}->{institutions}->{$inst};
+    $server->{policy}       = $server->{institution}->{policy};
+    $server->{sip_username} = $uid;
+    $server->{sip_password} = $pwd;
+
     siplog( "LOG_INFO", "Successful login/auth for '%s' of '%s'", $server->{account}->{id}, $inst );
 
     #