diff --git a/src/Security/BpnAuthenticator.php b/src/Security/BpnAuthenticator.php
index fc582b4..3bfd09d 100644
--- a/src/Security/BpnAuthenticator.php
+++ b/src/Security/BpnAuthenticator.php
@@ -118,6 +118,13 @@ class BpnAuthenticator extends AbstractLoginFormAuthenticator implements Authent
 
         // User is expected to have at least one role
         if (0 === count($roles)) {
+            // Revoke roles on existing local user to invalidate any active session
+            $existingUser = $this->userDataHandler->findLocalUser($profileResponse);
+            if (null !== $existingUser) {
+                $existingUser->setRoles([]);
+                $this->entityManager->flush();
+            }
+
             return null;
         }
 
diff --git a/src/Security/UserChecker.php b/src/Security/UserChecker.php
index 93baa21..6a7a29b 100644
--- a/src/Security/UserChecker.php
+++ b/src/Security/UserChecker.php
@@ -9,6 +9,13 @@ use Symfony\Component\Security\Core\User\UserInterface;
 
 class UserChecker implements UserCheckerInterface
 {
+    private const APPLICATION_ROLES = [
+        'ROLE_ADMIN',
+        'ROLE_MANAGER',
+        'ROLE_HOUSE_MANAGER',
+        'ROLE_TEAMER',
+    ];
+
     public function checkPreAuth(UserInterface $user): void
     {
         if (!$user instanceof User) {
@@ -18,6 +25,10 @@ class UserChecker implements UserCheckerInterface
         if (true === $user->isDisabled()) {
             throw new CustomUserMessageAccountStatusException('Dein Account wurde gesperrt: '.$user->getDisabledReason());
         }
+
+        if ([] === array_intersect($user->getRoles(), self::APPLICATION_ROLES)) {
+            throw new CustomUserMessageAccountStatusException('Keine gültige Rolle zugewiesen.');
+        }
     }
 
     public function checkPostAuth(UserInterface $user): void