diff --git a/CHANGES.txt b/CHANGES.txt
index e4539584a8..ca4d4b5a45 100644
--- a/CHANGES.txt
+++ b/CHANGES.txt
@@ -1,4 +1,5 @@
 2.0.17
+ * Avoid NPE in AuthSuccess#decode (CASSANDRA-9727)
  * Add listen_address to system.local (CASSANDRA-9603)
  * Bug fixes to resultset metadata construction (CASSANDRA-9636)
  * Fix setting 'durable_writes' in ALTER KEYSPACE (CASSANDRA-9560)
diff --git a/src/java/org/apache/cassandra/transport/messages/AuthSuccess.java b/src/java/org/apache/cassandra/transport/messages/AuthSuccess.java
index 2595f2846e..20bbed4f0a 100644
--- a/src/java/org/apache/cassandra/transport/messages/AuthSuccess.java
+++ b/src/java/org/apache/cassandra/transport/messages/AuthSuccess.java
@@ -36,8 +36,12 @@ public class AuthSuccess extends Message.Response
         public AuthSuccess decode(ChannelBuffer body, int version)
         {
             ByteBuffer b = CBUtil.readValue(body);
-            byte[] token = new byte[b.remaining()];
-            b.get(token);
+            byte[] token = null;
+            if (b != null)
+            {
+                token = new byte[b.remaining()];
+                b.get(token);
+            }
             return new AuthSuccess(token);
         }