diff --git a/typo3/sysext/core/Classes/Authentication/AbstractUserAuthentication.php b/typo3/sysext/core/Classes/Authentication/AbstractUserAuthentication.php
index 062807dd86a0b30070b58002204f2ef60d66071d..40e9fcb452a8b19e69eb99233374cef465270f46 100644
--- a/typo3/sysext/core/Classes/Authentication/AbstractUserAuthentication.php
+++ b/typo3/sysext/core/Classes/Authentication/AbstractUserAuthentication.php
@@ -627,14 +627,14 @@ abstract class AbstractUserAuthentication implements LoggerAwareInterface
         } else {
             $this->logger->debug('No user session found');
         }
-        if (is_array($this->svConfig['setup'])) {
+        if (is_array($this->svConfig['setup'] ?? false)) {
             $this->logger->debug('SV setup', $this->svConfig['setup']);
         }
 
         // Fetch user if ...
         if (
-            $activeLogin || $this->svConfig['setup'][$this->loginType . '_alwaysFetchUser']
-            || !$haveSession && $this->svConfig['setup'][$this->loginType . '_fetchUserIfNoSession']
+            $activeLogin || !empty($this->svConfig['setup'][$this->loginType . '_alwaysFetchUser'])
+            || !$haveSession && !empty($this->svConfig['setup'][$this->loginType . '_fetchUserIfNoSession'])
         ) {
             // Use 'auth' service to find the user
             // First found user will be used
@@ -675,7 +675,7 @@ abstract class AbstractUserAuthentication implements LoggerAwareInterface
             ]);
         }
         // Re-auth user when 'auth'-service option is set
-        if ($this->svConfig['setup'][$this->loginType . '_alwaysAuthUser']) {
+        if (!empty($this->svConfig['setup'][$this->loginType . '_alwaysAuthUser'])) {
             $authenticated = false;
             $this->logger->debug('alwaysAuthUser option is enabled');
         }
@@ -952,7 +952,7 @@ abstract class AbstractUserAuthentication implements LoggerAwareInterface
 
         $this->sessionData = unserialize($sessionRecord['ses_data']);
         // Session is anonymous so no need to fetch user
-        if ($sessionRecord['ses_anonymous']) {
+        if (!empty($sessionRecord['ses_anonymous'])) {
             return $sessionRecord;
         }
 
diff --git a/typo3/sysext/core/Classes/Authentication/BackendUserAuthentication.php b/typo3/sysext/core/Classes/Authentication/BackendUserAuthentication.php
index d1810f02392bf18a989ec7bba4626f734e78b189..01f693b6e403563a817fada4fee8ace44fe675de 100644
--- a/typo3/sysext/core/Classes/Authentication/BackendUserAuthentication.php
+++ b/typo3/sysext/core/Classes/Authentication/BackendUserAuthentication.php
@@ -1208,12 +1208,12 @@ class BackendUserAuthentication extends AbstractUserAuthentication
         if ($key !== '') {
             if (count($parts) > 1 && $parts[1] !== '') {
                 // Go on, get the next level
-                if (is_array($config[$key . '.'])) {
+                if (is_array($config[$key . '.'] ?? false)) {
                     $TSConf = $this->getTSConfig($parts[1], $config[$key . '.']);
                 }
             } else {
-                $TSConf['value'] = $config[$key];
-                $TSConf['properties'] = $config[$key . '.'];
+                $TSConf['value'] = $config[$key] ?? null;
+                $TSConf['properties'] = $config[$key . '.'] ?? null;
             }
         }
         return $TSConf;
@@ -2060,7 +2060,7 @@ class BackendUserAuthentication extends AbstractUserAuthentication
      */
     protected function initializeDbMountpointsInWorkspace()
     {
-        $dbMountpoints = trim($this->workspaceRec['db_mountpoints']);
+        $dbMountpoints = trim($this->workspaceRec['db_mountpoints'] ?? '');
         if ($this->workspace > 0 && $dbMountpoints != '') {
             $filteredDbMountpoints = [];
             // Notice: We cannot call $this->getPagePermsClause(1);