diff --git a/lib/curl_sasl.c b/lib/curl_sasl.c
index 2d55836cd3..3fa6f344df 100644
--- a/lib/curl_sasl.c
+++ b/lib/curl_sasl.c
@@ -1440,8 +1440,7 @@ CURLcode Curl_sasl_start(struct SASL *sasl, struct connectdata *conn,
       }
     else
 #endif
-    if((((enabledmechs & SASL_MECH_XOAUTH2) &&
-        sasl->prefmech != SASL_AUTH_DEFAULT)) || conn->xoauth2_bearer) {
+    if((enabledmechs & SASL_MECH_XOAUTH2) || conn->xoauth2_bearer) {
       mech = SASL_MECH_STRING_XOAUTH2;
       state1 = SASL_XOAUTH2;
       sasl->authused = SASL_MECH_XOAUTH2;
diff --git a/lib/curl_sasl.h b/lib/curl_sasl.h
index 985ca416ee..0dc73770fc 100644
--- a/lib/curl_sasl.h
+++ b/lib/curl_sasl.h
@@ -52,7 +52,8 @@ struct kerberos5data;
 /* Authentication mechanism values */
 #define SASL_AUTH_NONE          0
 #define SASL_AUTH_ANY           ~0U
-#define SASL_AUTH_DEFAULT       (SASL_AUTH_ANY & ~SASL_MECH_EXTERNAL)
+#define SASL_AUTH_DEFAULT       (SASL_AUTH_ANY & \
+                                 ~(SASL_MECH_EXTERNAL | SASL_MECH_XOAUTH2))
 
 /* Authentication mechanism strings */
 #define SASL_MECH_STRING_LOGIN      "LOGIN"