diff --git a/app/Controllers/authController.php b/app/Controllers/authController.php
index 9c0cb9c3e..13d92f5fd 100644
--- a/app/Controllers/authController.php
+++ b/app/Controllers/authController.php
@@ -118,6 +118,7 @@ class FreshRSS_auth_Controller extends FreshRSS_ActionController {
 
 		if ($isPOST) {
 			$nonce = Minz_Session::paramString('nonce');
+			Minz_Session::_param('nonce', false);	// One-time: consume the challenge so it cannot be replayed.
 			$username = Minz_Request::paramString('username');
 			$challenge = Minz_Request::paramString('challenge');
 			$ip_address = Minz_Request::connectionRemoteAddress();
@@ -215,6 +216,7 @@ class FreshRSS_auth_Controller extends FreshRSS_ActionController {
 		if (Minz_Request::isPost()) {
 			$username = Minz_User::name() ?? '';
 			$nonce = Minz_Session::paramString('nonce');
+			Minz_Session::_param('nonce', false);	// One-time: consume the challenge so it cannot be replayed.
 			$challenge = Minz_Request::paramString('challenge');
 			if (!FreshRSS_FormAuth::checkCredentials(
 				$username, FreshRSS_Context::userConf()->passwordHash, $nonce, $challenge
diff --git a/app/Controllers/userController.php b/app/Controllers/userController.php
index 6857b03ae..db9633dc1 100644
--- a/app/Controllers/userController.php
+++ b/app/Controllers/userController.php
@@ -174,6 +174,7 @@ class FreshRSS_user_Controller extends FreshRSS_ActionController {
 			if ($challenge !== '') {
 				$username = Minz_User::name();
 				$nonce = Minz_Session::paramString('nonce');
+				Minz_Session::_param('nonce', false);	// One-time: consume the challenge so it cannot be replayed.
 
 				$newPasswordPlain = Minz_Request::paramString('newPasswordPlain', plaintext: true);
 				$confirmPasswordPlain = Minz_Request::paramString('confirmPasswordPlain', plaintext: true);
@@ -701,6 +702,7 @@ class FreshRSS_user_Controller extends FreshRSS_ActionController {
 			if ($self_deletion) {
 				// We check the password if it’s a self-destruction
 				$nonce = Minz_Session::paramString('nonce');
+				Minz_Session::_param('nonce', false);	// One-time: consume the challenge so it cannot be replayed.
 				$challenge = Minz_Request::paramString('challenge');
 
 				$ok &= FreshRSS_FormAuth::checkCredentials(