diff --git a/lib/db/mysql.js b/lib/db/mysql.js
index c8b857dd1c1b8e9856c7cc337caadc0791635d77..8c2d805e63fed01488e4b6f82b561198c98369c1 100644
--- a/lib/db/mysql.js
+++ b/lib/db/mysql.js
@@ -291,7 +291,7 @@ exports.authForVerificationSecret = function(secret, cb) {
       if (o.passwd) return cb(null, o.passwd, o.existing_user);
 
       // otherwise, let's get the passwd from the user record
-      if (!o.existing_user) cb("no password for user");
+      if (!o.existing_user) return cb("no password for user");
 
       exports.checkAuth(o.existing_user, function(err, hash) {
         cb(err, hash, o.existing_user);