diff --git a/src/Symfony/Component/Security/Http/Authentication/AuthenticationUtils.php b/src/Symfony/Component/Security/Http/Authentication/AuthenticationUtils.php
index bd0f39139216c..e0aa5aff92764 100644
--- a/src/Symfony/Component/Security/Http/Authentication/AuthenticationUtils.php
+++ b/src/Symfony/Component/Security/Http/Authentication/AuthenticationUtils.php
@@ -56,7 +56,13 @@ public function getLastUsername(): string
             return $request->attributes->get(Security::LAST_USERNAME, '');
         }
 
-        return $request->hasSession() ? $request->getSession()->get(Security::LAST_USERNAME, '') : '';
+        if (!$request->hasSession()) {
+            return '';
+        }
+
+        $lastUsername = $request->getSession()->get(Security::LAST_USERNAME, '');
+
+        return \is_string($lastUsername) ? $lastUsername : '';
     }
 
     /**