diff --git a/hermes_cli/dashboard_auth/middleware.py b/hermes_cli/dashboard_auth/middleware.py
index 2c5f5b4f7b958..278ee502a2e73 100644
--- a/hermes_cli/dashboard_auth/middleware.py
+++ b/hermes_cli/dashboard_auth/middleware.py
@@ -185,6 +185,11 @@ def _auto_sso_response(request: Request) -> Response | None:
     from hermes_cli.dashboard_auth.prefix import prefix_from_request
 
     provider = providers[0]
+    # Password-only providers (e.g. dashboard_auth/basic) do not implement
+    # OAuth start_login and must use /login -> /auth/password-login.
+    # Auto-SSO should only fire for redirect-capable providers.
+    if bool(getattr(provider, "supports_password", False)):
+        return None
     prefix = prefix_from_request(request)
     next_param = _safe_next_target(request)
     from urllib.parse import quote