diff --git a/include/authorization.hpp b/include/authorization.hpp
index f8e74b9..d50695b 100644
--- a/include/authorization.hpp
+++ b/include/authorization.hpp
@@ -247,6 +247,8 @@
     {
         if ((url == "/redfish/v1/SessionService/Sessions") ||
             (url == "/redfish/v1/SessionService/Sessions/") ||
+            (url == "/redfish/v1/SessionService/Sessions/Members") ||
+            (url == "/redfish/v1/SessionService/Sessions/Members/") ||
             (url == "/login"))
         {
             return true;
diff --git a/redfish-core/lib/redfish_sessions.hpp b/redfish-core/lib/redfish_sessions.hpp
index 5e7d3df..3c2247b 100644
--- a/redfish-core/lib/redfish_sessions.hpp
+++ b/redfish-core/lib/redfish_sessions.hpp
@@ -273,7 +273,7 @@
         .privileges(redfish::privileges::getSessionCollection)
         .methods(boost::beast::http::verb::get)(handleSessionCollectionGet);
 
-    // Note, the next route technically doesn't match the privilege
+    // Note, the next two routes technically don't match the privilege
     // registry given the way login mechanisms work.  The base privilege
     // registry lists this endpoint as requiring login privilege, but because
     // this is the endpoint responsible for giving the login privilege, and it
@@ -282,6 +282,10 @@
         .privileges({})
         .methods(boost::beast::http::verb::post)(handleSessionCollectionPost);
 
+    BMCWEB_ROUTE(app, "/redfish/v1/SessionService/Sessions/Members/")
+        .privileges({})
+        .methods(boost::beast::http::verb::post)(handleSessionCollectionPost);
+
     BMCWEB_ROUTE(app, "/redfish/v1/SessionService/")
         .privileges(redfish::privileges::getSessionService)
         .methods(boost::beast::http::verb::get)(handleSessionServiceGet);