diff --git a/Classes/GraphQL/Middleware/GraphQLMiddleware.php b/Classes/GraphQL/Middleware/GraphQLMiddleware.php
index e20596dc4..ec5c94ec4 100644
--- a/Classes/GraphQL/Middleware/GraphQLMiddleware.php
+++ b/Classes/GraphQL/Middleware/GraphQLMiddleware.php
@@ -32,6 +32,7 @@
 use Neos\Flow\Log\ThrowableStorageInterface;
 use Neos\Flow\Mvc\ActionRequest;
 use Neos\Flow\Persistence\PersistenceManagerInterface;
+use Neos\Flow\Security\Authentication\AuthenticationManagerInterface;
 use Neos\Flow\Security\Context;
 use Psr\Container\ContainerInterface;
 use Psr\Http\Message\ResponseFactoryInterface;
@@ -66,6 +67,7 @@ public function __construct(
         private readonly ContainerInterface $serviceLocator,
         private readonly CustomResolvers $customResolvers,
         private readonly PersistenceManagerInterface $persistenceManager,
+        private readonly AuthenticationManagerInterface $authenticationManager,
     ) {
     }
 
@@ -78,9 +80,10 @@ public function process(ServerRequestInterface $request, RequestHandlerInterface
         }
         if ($this->simulateControllerObjectName !== null) {
             $mockActionRequest = ActionRequest::fromHttpRequest($request);
-            // Simulate a request to the specified controller to trigger authentication
+            // Simulate a request to the specified controller
             $mockActionRequest->setControllerObjectName($this->simulateControllerObjectName);
             $this->securityContext->setRequest($mockActionRequest);
+            $this->authenticationManager->isAuthenticated();  // Trigger authentication if isAuthenticated is null
         }
         $response = $this->responseFactory->createResponse();
         $response = $this->addCorsHeaders($response);
diff --git a/Classes/GraphQL/Middleware/GraphQLMiddlewareFactory.php b/Classes/GraphQL/Middleware/GraphQLMiddlewareFactory.php
index 26ba68fff..a2099e691 100644
--- a/Classes/GraphQL/Middleware/GraphQLMiddlewareFactory.php
+++ b/Classes/GraphQL/Middleware/GraphQLMiddlewareFactory.php
@@ -22,6 +22,7 @@
 use Neos\Flow\Log\ThrowableStorageInterface;
 use Neos\Flow\ObjectManagement\ObjectManagerInterface;
 use Neos\Flow\Persistence\PersistenceManagerInterface;
+use Neos\Flow\Security\Authentication\AuthenticationManagerInterface;
 use Neos\Flow\Security\Context;
 use Psr\Http\Message\ResponseFactoryInterface;
 use Psr\Http\Message\StreamFactoryInterface;
@@ -40,6 +41,7 @@ public function __construct(
         private readonly ObjectManagerInterface $objectManager,
         private readonly CustomResolversFactory $customResolversFactory,
         private readonly PersistenceManagerInterface $persistenceManager,
+        private readonly AuthenticationManagerInterface $authenticationManager,
     ) {
     }
 
@@ -65,6 +67,7 @@ public function create(
             $this->objectManager,
             $this->customResolversFactory->create($customResolversSettings ?? []),
             $this->persistenceManager,
+            $this->authenticationManager,
         );
     }
 }