diff --git a/api/src/Vfs/Base.php b/api/src/Vfs/Base.php
index 59e2232db2..ea61c6bf27 100644
--- a/api/src/Vfs/Base.php
+++ b/api/src/Vfs/Base.php
@@ -295,6 +295,16 @@ class Base
 			'host' => $GLOBALS['egw_info']['user']['domain'],
 			'home' => str_replace(array('\\\\', '\\'), array('', '/'), $GLOBALS['egw_info']['user']['homedirectory'] ?? ''),
 		);
+		// check if we have a (base64 encoded) fallback-auth GET parameter and need to use it
+		if (empty($GLOBALS['egw_info']['user']['passwd']) && strpos(($query=Vfs::parse_url($_path, PHP_URL_QUERY)), 'fallback-auth=') !== false)
+		{
+			parse_str($query, $query_params);
+			if (!empty($query_params['fallback-auth']) && ($raw = base64_decode($query_params['fallback-auth'])) && strpos($raw, ':') !== false)
+			{
+				list($defaults['user'], $defaults['pass']) = explode(':', $raw, 2);
+				$defaults['pass'] = urlencode($defaults['pass']);
+			}
+		}
 		$parts = array_merge(Vfs::parse_url($_path), Vfs::parse_url($path) ?: [], $defaults);
 		if(!$parts['host'])
 		{