diff --git a/Projects/UOContent.Tests/Tests/Network/Packets/AuthIdTests.cs b/Projects/UOContent.Tests/Tests/Network/Packets/AuthIdTests.cs
index fc66c6277..0f93bdf66 100644
--- a/Projects/UOContent.Tests/Tests/Network/Packets/AuthIdTests.cs
+++ b/Projects/UOContent.Tests/Tests/Network/Packets/AuthIdTests.cs
@@ -3,6 +3,7 @@ using System.Net;
 using Server.Accounting;
 using Server.Accounting.Security;
 using Server.Network;
+using Server.Tests.Network;
 using Xunit;
 
 namespace Server.Tests.Network.Packets;
@@ -142,6 +143,34 @@ public class AuthIdTests : IDisposable
         );
     }
 
+    [Fact]
+    public void PreAuthenticatedGameLogin_SkipsThePasswordCheck()
+    {
+        var account = CreateAccount("authid-preauth-user");
+        using var ns = PacketTestUtilities.CreateTestNetState();
+
+        // A wrong password is accepted only because the auth id already vouched for the account.
+        var e = new GameServer.GameLoginEventArgs(ns, account.Username, "wrong-password", true);
+        GameServer.GameServerLoginEvent(e);
+
+        Assert.True(e.Accepted);
+    }
+
+    [Fact]
+    public void GameLoginWithoutPreAuthentication_StillChecksThePassword()
+    {
+        var account = CreateAccount("authid-nopreauth-user");
+        using var ns = PacketTestUtilities.CreateTestNetState();
+
+        var wrong = new GameServer.GameLoginEventArgs(ns, account.Username, "wrong-password", false);
+        GameServer.GameServerLoginEvent(wrong);
+        Assert.False(wrong.Accepted);
+
+        var right = new GameServer.GameLoginEventArgs(ns, account.Username, "hunter2", false);
+        GameServer.GameServerLoginEvent(right);
+        Assert.True(right.Accepted);
+    }
+
     [Fact]
     public void GeneratesDistinctAuthIds()
     {
diff --git a/Projects/UOContent/Accounting/AccountHandler.cs b/Projects/UOContent/Accounting/AccountHandler.cs
index ea0c4b9e0..1896883cf 100644
--- a/Projects/UOContent/Accounting/AccountHandler.cs
+++ b/Projects/UOContent/Accounting/AccountHandler.cs
@@ -343,7 +343,10 @@ public static class AccountHandler
             logger.Information("Login: {NetState} Access denied for '{Username}'", e.State, un);
             e.Accepted = false;
         }
-        else if (!acct.CheckPassword(pw))
+        // The auth id already vouched for this account from this address, and it was only issued
+        // after the account login packet verified the password. Re-deriving the hash here costs
+        // another full Argon2 verify to answer a question already answered.
+        else if (!e.PreAuthenticated && !acct.CheckPassword(pw))
         {
             logger.Information("Login: {NetState} Invalid password for '{Username}'", e.State, un);
             e.Accepted = false;
diff --git a/Projects/UOContent/Network/GameServer.cs b/Projects/UOContent/Network/GameServer.cs
index 9fc170d69..72f886164 100644
--- a/Projects/UOContent/Network/GameServer.cs
+++ b/Projects/UOContent/Network/GameServer.cs
@@ -6,13 +6,21 @@ public static partial class GameServer
 {
     public class GameLoginEventArgs
     {
-        public GameLoginEventArgs(NetState state, string un, string pw)
+        public GameLoginEventArgs(NetState state, string un, string pw, bool preAuthenticated)
         {
             State = state;
             Username = un;
             Password = pw;
+            PreAuthenticated = preAuthenticated;
         }
 
+        /// <summary>
+        /// The auth id presented on this game login was issued to this account, from this address,
+        /// after the account login packet already verified the password. Read-only: a subscriber
+        /// must not be able to grant itself the skip.
+        /// </summary>
+        public bool PreAuthenticated { get; }
+
         public NetState State { get; }
 
         public string Username { get; }
diff --git a/Projects/UOContent/Network/Packets/IncomingAccountPackets.cs b/Projects/UOContent/Network/Packets/IncomingAccountPackets.cs
index 8d34bb06a..3d3f825a7 100644
--- a/Projects/UOContent/Network/Packets/IncomingAccountPackets.cs
+++ b/Projects/UOContent/Network/Packets/IncomingAccountPackets.cs
@@ -416,12 +416,6 @@ public static class IncomingAccountPackets
 
         var authId = reader.ReadInt32();
 
-        if (!_authIDWindow.TryGetValue(authId, out var ap))
-        {
-            state.LogInfo("Invalid client detected, disconnecting...");
-            state.Disconnect("Unable to find auth id.");
-        }
-
         if (state.AuthId != 0 && authId != state.AuthId || state.AuthId == 0 && authId != state.Seed)
         {
             state.LogInfo("Invalid client detected, disconnecting...");
@@ -429,14 +423,28 @@ public static class IncomingAccountPackets
             return;
         }
 
-        _authIDWindow.Remove(authId);
-        state.Version = ap.Version;
-        state.Seeded = true;
-
         var username = reader.ReadLatin1Safe(30);
         var password = reader.ReadLatin1Safe(30);
 
-        var e = new GameServer.GameLoginEventArgs(state, username, password);
+        // Spends the id either way, so a guessed one cannot be reused to probe usernames.
+        var authResult = ConsumeAuthId(authId, username, state.Address, out var ap);
+
+        if (authResult == AuthIdResult.Rejected)
+        {
+            state.LogInfo("Invalid client detected, disconnecting...");
+            state.Disconnect("Unable to find auth id.");
+            return;
+        }
+
+        state.Version = ap.Version;
+        state.Seeded = true;
+
+        var e = new GameServer.GameLoginEventArgs(
+            state,
+            username,
+            password,
+            authResult == AuthIdResult.Vouched
+        );
 
         GameServer.GameServerLoginEvent(e);