diff --git a/include/rfb.js b/include/rfb.js
index ec2fd84c..a7120a54 100644
--- a/include/rfb.js
+++ b/include/rfb.js
@@ -810,6 +810,11 @@ var RFB;
             // second pass, do the sub-auth negotiation
             if (this._sock.rQwait("sub auth count", 4)) { return false; }
             var subAuthCount = this._sock.rQshift32();
+            if (subAuthCount === 0) {  // empty sub-auth list received means 'no auth' subtype selected
+                this._updateState('SecurityResult');
+                return true;
+            }
+
             if (this._sock.rQwait("sub auth capabilities", 16 * subAuthCount, 4)) { return false; }
 
             var clientSupportedTypes = {