diff --git a/CHANGES.txt b/CHANGES.txt
index a160b09ae9..9973bbca19 100644
--- a/CHANGES.txt
+++ b/CHANGES.txt
@@ -34,6 +34,7 @@ Merged from 2.1:
  * Fix memory leak in Ref due to ConcurrentLinkedQueue.remove() behaviour (CASSANDRA-9549)
  * Make rebuild only run one at a time (CASSANDRA-9119)
 Merged from 2.0:
+ * Avoid NPE in AuthSuccess#decode (CASSANDRA-9727)
  * Add listen_address to system.local (CASSANDRA-9603)
  * Bug fixes to resultset metadata construction (CASSANDRA-9636)
  * Fix setting 'durable_writes' in ALTER KEYSPACE (CASSANDRA-9560)
diff --git a/src/java/org/apache/cassandra/transport/messages/AuthSuccess.java b/src/java/org/apache/cassandra/transport/messages/AuthSuccess.java
index 98f50db437..8c1b5b1a8c 100644
--- a/src/java/org/apache/cassandra/transport/messages/AuthSuccess.java
+++ b/src/java/org/apache/cassandra/transport/messages/AuthSuccess.java
@@ -36,8 +36,12 @@ public class AuthSuccess extends Message.Response
         public AuthSuccess decode(ByteBuf body, int version)
         {
             ByteBuffer b = CBUtil.readValue(body);
-            byte[] token = new byte[b.remaining()];
-            b.get(token);
+            byte[] token = null;
+            if (b != null)
+            {
+                token = new byte[b.remaining()];
+                b.get(token);
+            }
             return new AuthSuccess(token);
         }