diff --git a/src/client/ua_client_connect.c b/src/client/ua_client_connect.c
index f1b0050460d..6089d87a999 100644
--- a/src/client/ua_client_connect.c
+++ b/src/client/ua_client_connect.c
@@ -600,7 +600,7 @@ selectEndpoint(UA_Client *client, const UA_String endpointUrl) {
             UA_UserTokenPolicy* userToken = &endpoint->userIdentityTokens[j];
 
             /* Usertokens also have a security policy... */
-            if (tokenPolicy->tokenType != UA_USERTOKENTYPE_ANONYMOUS && 
+            if (userToken->tokenType != UA_USERTOKENTYPE_ANONYMOUS && 
                 userToken->securityPolicyUri.length > 0 &&
                 !getSecurityPolicy(client, userToken->securityPolicyUri)) {
                 UA_LOG_INFO(&client->config.logger, UA_LOGCATEGORY_CLIENT, "Rejecting UserTokenPolicy %lu in endpoint %lu: security policy '%.*s' not available",