diff --git a/apps/console/src/pages/iam/auth/sign-in/PasswordSignInPage.tsx b/apps/console/src/pages/iam/auth/sign-in/PasswordSignInPage.tsx
index 99f205d94..f55d4d83d 100644
--- a/apps/console/src/pages/iam/auth/sign-in/PasswordSignInPage.tsx
+++ b/apps/console/src/pages/iam/auth/sign-in/PasswordSignInPage.tsx
@@ -3,7 +3,7 @@ import { useTranslate } from "@probo/i18n";
 import { Button, Field, IconChevronLeft, useToast } from "@probo/ui";
 import type { FormEventHandler } from "react";
 import { useMutation } from "react-relay";
-import { Link, useLocation, useSearchParams } from "react-router";
+import { Link, useLocation, useNavigate, useSearchParams } from "react-router";
 import { graphql } from "relay-runtime";
 
 import type { PasswordSignInPageMutation } from "#/__generated__/iam/PasswordSignInPageMutation.graphql";
@@ -21,6 +21,7 @@ const signInMutation = graphql`
 export default function PasswordSignInPage() {
   const location = useLocation();
   const [searchParams] = useSearchParams();
+  const navigate = useNavigate();
 
   const { __ } = useTranslate();
   const { toast } = useToast();
@@ -58,7 +59,7 @@ export default function PasswordSignInPage() {
           return;
         }
 
-        window.location.href = searchParams.get("redirect-path") ?? "/";
+        void navigate(searchParams.get("redirect-path") ?? "/");
       },
       onError: (e) => {
         toast({
diff --git a/apps/console/src/pages/iam/auth/sign-in/SSOSignInPage.tsx b/apps/console/src/pages/iam/auth/sign-in/SSOSignInPage.tsx
index 60bf8a75d..9066ae615 100644
--- a/apps/console/src/pages/iam/auth/sign-in/SSOSignInPage.tsx
+++ b/apps/console/src/pages/iam/auth/sign-in/SSOSignInPage.tsx
@@ -40,7 +40,7 @@ export default function SSOSignInPage() {
     <>
       <form className="space-y-6 w-full max-w-md mx-auto pt-4" onSubmit={handleSSOCheck}>
         <Link
-          to={{ pathname: "/auth/register", search: location.search }}
+          to={{ pathname: "/auth/login", search: location.search }}
           className="flex items-center gap-2 text-txt-secondary hover:text-txt-primary transition-colors mb-4"
         >
           <IconChevronLeft size={20} />
diff --git a/apps/console/src/pages/iam/memberships/_components/MembershipCard.tsx b/apps/console/src/pages/iam/memberships/_components/MembershipCard.tsx
index 5f890d902..a09af7836 100644
--- a/apps/console/src/pages/iam/memberships/_components/MembershipCard.tsx
+++ b/apps/console/src/pages/iam/memberships/_components/MembershipCard.tsx
@@ -41,9 +41,9 @@ export function MembershipCard(props: MembershipCardProps) {
     fragment,
     fKey,
   );
-  const isAssuming = !!lastSession;
   const isExpired
     = lastSession && parseDate(lastSession.expiresAt) < new Date();
+  const isAssuming = !!lastSession && !isExpired;
 
   const getAuthBadge = () => {
     if (isAssuming) {
diff --git a/apps/console/src/pages/iam/organizations/AssumePage.tsx b/apps/console/src/pages/iam/organizations/AssumePage.tsx
index fad5916c1..46a286561 100644
--- a/apps/console/src/pages/iam/organizations/AssumePage.tsx
+++ b/apps/console/src/pages/iam/organizations/AssumePage.tsx
@@ -70,7 +70,7 @@ function AssumePageInner() {
             search.set("organization-id", organizationId);
             search.set("redirect-path", redirectPath);
 
-            void navigate({ pathname: "/auth/passord-login", search: "?" + search.toString() });
+            void navigate({ pathname: "/auth/password-login", search: "?" + search.toString() });
             break;
           case "SAMLAuthenticationRequired":
             samlSSOLoginURL = new URL(result.redirectUrl);
diff --git a/pkg/iam/session_service.go b/pkg/iam/session_service.go
index d9ff2f15d..8e0cf02f3 100644
--- a/pkg/iam/session_service.go
+++ b/pkg/iam/session_service.go
@@ -321,11 +321,12 @@ func (s SessionService) OpenPasswordChildSessionForOrganization(
 	organizationID gid.GID,
 ) (*coredata.Session, *coredata.Membership, error) {
 	var (
-		now         = time.Now()
-		rootSession = &coredata.Session{}
-		identity    = &coredata.Identity{}
-		membership  = &coredata.Membership{}
-		scope       = coredata.NewScopeFromObjectID(organizationID)
+		now          = time.Now()
+		rootSession  = &coredata.Session{}
+		identity     = &coredata.Identity{}
+		membership   = &coredata.Membership{}
+		childSession = &coredata.Session{}
+		scope        = coredata.NewScopeFromObjectID(organizationID)
 	)
 
 	err := s.pg.WithTx(
@@ -365,7 +366,7 @@ func (s SessionService) OpenPasswordChildSessionForOrganization(
 			}
 
 			tenantID := scope.GetTenantID()
-			childSession := &coredata.Session{
+			childSession = &coredata.Session{
 				ID:              gid.New(tenantID, coredata.SessionEntityType),
 				IdentityID:      rootSession.IdentityID,
 				TenantID:        &tenantID,
@@ -398,7 +399,7 @@ func (s SessionService) OpenPasswordChildSessionForOrganization(
 		return nil, nil, err
 	}
 
-	return rootSession, membership, nil
+	return childSession, membership, nil
 }
 
 // OpenSAMLChildSessionForOrganization creates a SAML-authenticated child session for the given
@@ -535,7 +536,7 @@ func (s SessionService) AssumeOrganizationSession(
 			}
 
 			// If child session already exists use it
-			if err := childSession.LoadByRootSessionIDAndMembershipID(ctx, tx, rootSession.IdentityID, membership.ID); err == nil {
+			if err := childSession.LoadByRootSessionIDAndMembershipID(ctx, tx, rootSession.ID, membership.ID); err == nil {
 				if childSession.ExpireReason == nil && now.Before(childSession.ExpiredAt) {
 					return nil
 				}
diff --git a/pkg/server/api/connect/v1/v1_resolver.go b/pkg/server/api/connect/v1/v1_resolver.go
index 89012e773..e56e985f7 100644
--- a/pkg/server/api/connect/v1/v1_resolver.go
+++ b/pkg/server/api/connect/v1/v1_resolver.go
@@ -408,13 +408,13 @@ func (r *mutationResolver) SignIn(ctx context.Context, input types.SignInInput)
 
 	if input.OrganizationID != nil {
 		var err error
-		session, _, err = r.iam.SessionService.OpenPasswordChildSessionForOrganization(ctx, session.ID, *input.OrganizationID)
+		_, _, err = r.iam.SessionService.OpenPasswordChildSessionForOrganization(ctx, session.ID, *input.OrganizationID)
 		if err != nil {
 			// Here session middleware already took care of expired/nil root session so we only handle membership related errors
 			var errMembershipNotFound *iam.ErrMembershipNotFound
 			var errMembershipInactive *iam.ErrMembershipInactive
 
-			if errors.As(err, errMembershipNotFound) || errors.As(err, errMembershipInactive) {
+			if errors.As(err, &errMembershipNotFound) || errors.As(err, &errMembershipInactive) {
 				return nil, gqlutils.Forbidden(ctx, err)
 			}