diff --git a/internal/mcpproxy/handlers.go b/internal/mcpproxy/handlers.go
index c8892354e2..2cb797f016 100644
--- a/internal/mcpproxy/handlers.go
+++ b/internal/mcpproxy/handlers.go
@@ -1228,6 +1228,9 @@ func extractSubject(r *http.Request) string {
 	if !strings.EqualFold(parts[0], "bearer") {
 		return ""
 	}
+	if len(parts) < 2 {
+		return ""
+	}
 
 	var claims jwt.RegisteredClaims
 	_, _, _ = jwt.NewParser().ParseUnverified(parts[1], &claims)
diff --git a/internal/mcpproxy/handlers_test.go b/internal/mcpproxy/handlers_test.go
index 31ae30cf8f..9314221eb3 100644
--- a/internal/mcpproxy/handlers_test.go
+++ b/internal/mcpproxy/handlers_test.go
@@ -1263,6 +1263,13 @@ func TestExtractSubject(t *testing.T) {
 		require.NoError(t, err)
 		require.Empty(t, extractSubject(req))
 	})
+
+	t.Run("bearer with no token", func(t *testing.T) {
+		req, err := http.NewRequest("GET", "/mcp", nil)
+		require.NoError(t, err)
+		req.Header.Set("Authorization", "bearer")
+		require.Empty(t, extractSubject(req))
+	})
 }
 
 func TestExtractForwardHeaders(t *testing.T) {