diff --git a/libfreerdp/core/credssp_auth.c b/libfreerdp/core/credssp_auth.c
index 8b4c0cba2..0fa545a2b 100644
--- a/libfreerdp/core/credssp_auth.c
+++ b/libfreerdp/core/credssp_auth.c
@@ -34,6 +34,7 @@
 
 #include <freerdp/log.h>
 
+#include "utils.h"
 #include "credssp_auth.h"
 
 #define TAG FREERDP_TAG("core.auth")
@@ -197,7 +198,7 @@ static BOOL credssp_auth_client_init_cred_attributes(rdpCredsspAuth* auth)
 {
 	WINPR_ASSERT(auth);
 
-	if (auth->kerberosSettings.kdcUrl)
+	if (!utils_str_is_empty(auth->kerberosSettings.kdcUrl))
 	{
 		SECURITY_STATUS status = ERROR_INTERNAL_ERROR;
 		SecPkgCredentials_KdcProxySettingsW* secAttr = NULL;
diff --git a/winpr/libwinpr/sspi/Kerberos/krb5glue_mit.c b/winpr/libwinpr/sspi/Kerberos/krb5glue_mit.c
index 619f02968..753b41ee8 100644
--- a/winpr/libwinpr/sspi/Kerberos/krb5glue_mit.c
+++ b/winpr/libwinpr/sspi/Kerberos/krb5glue_mit.c
@@ -21,6 +21,8 @@
 #error "This file must only be included with MIT kerberos"
 #endif
 
+#include <string.h>
+
 #include <winpr/path.h>
 #include <winpr/wlog.h>
 #include <winpr/endian.h>
@@ -171,7 +173,7 @@ krb5_error_code krb5glue_get_init_creds(krb5_context ctx, krb5_principal princ,
 			if (rv)
 				goto cleanup;
 		}
-		if (krb_settings->kdcUrl)
+		if (krb_settings->kdcUrl && (strnlen(krb_settings->kdcUrl, 2) > 0))
 		{
 			const char* names[4] = { 0 };
 			char* realm = NULL;