diff --git a/lib/krb5/init_creds_pw.c b/lib/krb5/init_creds_pw.c
index 6accf1137..302f43350 100644
--- a/lib/krb5/init_creds_pw.c
+++ b/lib/krb5/init_creds_pw.c
@@ -442,7 +442,8 @@ krb5_get_init_creds_password(krb5_context context,
 	case KRB5KDC_ERR_KEY_EXPIRED :
 	    /* try to avoid recursion */
 
-	    if (strcmp (in_tkt_service, "kadmin/changepw") == 0)
+	    if (in_tkt_service != NULL
+		&& strcmp (in_tkt_service, "kadmin/changepw") == 0)
 		goto out;
 
 	    ret = change_password (context,