diff --git a/pkg/iam/session_service.go b/pkg/iam/session_service.go
index 10ff57403..73dd1aef4 100644
--- a/pkg/iam/session_service.go
+++ b/pkg/iam/session_service.go
@@ -285,6 +285,10 @@ func (s SessionService) GetActiveSessionForMembership(ctx context.Context, rootS
 				return fmt.Errorf("session %q is not a root session", rootSessionID)
 			}
 
+			if rootSession.ExpireReason != nil || time.Now().After(rootSession.ExpiredAt) {
+				return NewSessionExpiredError(rootSessionID)
+			}
+
 			membership := &coredata.Membership{}
 			err = membership.LoadByID(ctx, tx, coredata.NewScopeFromObjectID(membershipID), membershipID)
 			if err != nil {