diff --git a/mxaccesscli/src/MxAccess.Cli/Mx/MxSession.cs b/mxaccesscli/src/MxAccess.Cli/Mx/MxSession.cs
index 8452804..a4577a8 100644
--- a/mxaccesscli/src/MxAccess.Cli/Mx/MxSession.cs
+++ b/mxaccesscli/src/MxAccess.Cli/Mx/MxSession.cs
@@ -58,7 +58,19 @@ namespace MxAccess.Cli.Mx
         {
             if (string.IsNullOrEmpty(verifyUser))
                 throw new ArgumentException("verifyUser must be non-empty.", nameof(verifyUser));
-            return _proxy.AuthenticateUser(_hServer, verifyUser, password ?? string.Empty);
+            // Some galaxy configurations (e.g. eOSUserBased) cause the proxy to
+            // throw `ArgumentException: Value does not fall within the expected
+            // range` for bad credentials instead of returning 0 like the
+            // permissive (eNone) configuration does. Both shapes mean "auth
+            // failed"; the caller distinguishes via a non-zero return value.
+            try
+            {
+                return _proxy.AuthenticateUser(_hServer, verifyUser, password ?? string.Empty);
+            }
+            catch (ArgumentException)
+            {
+                return 0;
+            }
         }
 
         /// Pump COM messages while watching for an update that matches the predicate.