diff --git a/vertx-auth-common/src/main/java/io/vertx/ext/auth/impl/UserImpl.java b/vertx-auth-common/src/main/java/io/vertx/ext/auth/impl/UserImpl.java
index c025188a2..8be18665e 100644
--- a/vertx-auth-common/src/main/java/io/vertx/ext/auth/impl/UserImpl.java
+++ b/vertx-auth-common/src/main/java/io/vertx/ext/auth/impl/UserImpl.java
@@ -128,7 +128,7 @@ public User merge(User other) {
           Object rhsValue = otherAttrs.getValue(key);
           // accumulate
           if (lhsValue == null) {
-            attrs.put(key, rhsValue instanceof JsonArray ? new JsonArray().add(rhsValue) : rhsValue);
+            attrs.put(key, rhsValue instanceof JsonArray ? new JsonArray().addAll((JsonArray) rhsValue) : rhsValue);
           } else if (lhsValue instanceof JsonArray) {
             if (rhsValue instanceof JsonArray) {
               ((JsonArray) lhsValue).addAll((JsonArray) rhsValue);
diff --git a/vertx-auth-common/src/test/java/io/vertx/ext/auth/UserTest.java b/vertx-auth-common/src/test/java/io/vertx/ext/auth/UserTest.java
index d4d5e1007..03b2c7ea1 100644
--- a/vertx-auth-common/src/test/java/io/vertx/ext/auth/UserTest.java
+++ b/vertx-auth-common/src/test/java/io/vertx/ext/auth/UserTest.java
@@ -159,5 +159,27 @@ public void testMerge() {
     // expectation
     assertEquals("B", userA.principal().getString("access_token"));
     assertEquals(new JsonArray().add("read").add("write"), userA.attributes().getJsonArray("roles"));
+
+    // or 1st is array and 2nd is null
+
+    userA = User.create(new JsonObject().put("access_token", "A"), new JsonObject().put("roles", new JsonArray().add("read")));
+    userB = User.create(new JsonObject().put("access_token", "B"));
+
+    userA.merge(userB);
+
+    // expectation
+    assertEquals("B", userA.principal().getString("access_token"));
+    assertEquals(new JsonArray().add("read"), userA.attributes().getJsonArray("roles"));
+
+    // or 1st is null and 2nd is array
+
+    userA = User.create(new JsonObject().put("access_token", "A"));
+    userB = User.create(new JsonObject().put("access_token", "B"), new JsonObject().put("roles", new JsonArray().add("write")));
+
+    userA.merge(userB);
+
+    // expectation
+    assertEquals("B", userA.principal().getString("access_token"));
+    assertEquals(new JsonArray().add("write"), userA.attributes().getJsonArray("roles"));
   }
 }