diff --git a/services/src/main/java/org/keycloak/utils/RoleResolveUtil.java b/services/src/main/java/org/keycloak/utils/RoleResolveUtil.java
index ddd1cc10bcb..ffc229eda3f 100644
--- a/services/src/main/java/org/keycloak/utils/RoleResolveUtil.java
+++ b/services/src/main/java/org/keycloak/utils/RoleResolveUtil.java
@@ -122,6 +122,9 @@ public class RoleResolveUtil {
 
         } else {
             ClientModel app = (ClientModel) role.getContainer();
+            if (app == null) {
+                return;
+            }
             access = token.getResourceAccess(app.getClientId());
             if (access == null) {
                 access = token.addAccess(app.getClientId());