diff --git a/src/db/models/auth_request.rs b/src/db/models/auth_request.rs
index b06c9e56..b28c69f7 100644
--- a/src/db/models/auth_request.rs
+++ b/src/db/models/auth_request.rs
@@ -166,6 +166,15 @@ impl AuthRequest {
         .await
     }
 
+    pub async fn delete_all_by_user(user_uuid: &UserId, conn: &DbConn) -> EmptyResult {
+        conn.run(move |conn| {
+            diesel::delete(auth_requests::table.filter(auth_requests::user_uuid.eq(user_uuid)))
+                .execute(conn)
+                .map_res("Error deleting auth requests for user")
+        })
+        .await
+    }
+
     /// Marks the request as used to log in. Returns false when it already was, so it only works once.
     pub async fn set_authentication_date(uuid: &AuthRequestId, conn: &DbConn) -> ApiResult<bool> {
         let now = Utc::now().naive_utc();
diff --git a/src/db/models/user.rs b/src/db/models/user.rs
index 6610c945..2f3afc02 100644
--- a/src/db/models/user.rs
+++ b/src/db/models/user.rs
@@ -19,7 +19,8 @@ use crate::{
 use macros::UuidFromParam;
 
 use super::{
-    Cipher, Device, EmergencyAccess, Favorite, Folder, Membership, MembershipType, TwoFactor, TwoFactorIncomplete,
+    AuthRequest, Cipher, Device, EmergencyAccess, Favorite, Folder, Membership, MembershipType, TwoFactor,
+    TwoFactorIncomplete,
 };
 
 #[derive(Identifiable, Queryable, Insertable, AsChangeset, Selectable)]
@@ -377,6 +378,7 @@ impl User {
         Cipher::delete_all_by_user(&self.uuid, conn).await?;
         Favorite::delete_all_by_user(&self.uuid, conn).await?;
         Folder::delete_all_by_user(&self.uuid, conn).await?;
+        AuthRequest::delete_all_by_user(&self.uuid, conn).await?;
         Device::delete_all_by_user(&self.uuid, conn).await?;
         TwoFactor::delete_all_by_user(&self.uuid, conn).await?;
         TwoFactorIncomplete::delete_all_by_user(&self.uuid, conn).await?;