diff --git a/core/src/main/java/io/undertow/security/impl/SingleSignOnAuthenticationMechanism.java b/core/src/main/java/io/undertow/security/impl/SingleSignOnAuthenticationMechanism.java
index <HASH>..<HASH> 100644
--- a/core/src/main/java/io/undertow/security/impl/SingleSignOnAuthenticationMechanism.java
+++ b/core/src/main/java/io/undertow/security/impl/SingleSignOnAuthenticationMechanism.java
@@ -169,7 +169,11 @@ public class SingleSignOnAuthenticationMechanism implements AuthenticationMechan
                         if (reason == SessionDestroyedReason.INVALIDATED) {
                             for (Session associatedSession : sso) {
                                 associatedSession.invalidate(null);
+                                sso.remove(associatedSession);
                             }
+                        }
+                        // If there are no more associated sessions, remove the SSO altogether
+                        if (!sso.iterator().hasNext()) {
                             manager.removeSingleSignOn(ssoId);
                         }
                     } finally {
UNDERTOW-<I> SSO not destroyed when the last associated session times out