diff --git a/scripts/base/protocols/http/main.zeek b/scripts/base/protocols/http/main.zeek
index f54216b0dd..e0f0cdc0a0 100644
--- a/scripts/base/protocols/http/main.zeek
+++ b/scripts/base/protocols/http/main.zeek
@@ -290,7 +290,7 @@ event http_header(c: connection, is_orig: bool, name: string, value: string) &pr
 			{
 			if ( /^[bB][aA][sS][iI][cC] / in value )
 				{
-				local userpass = decode_base64_conn(c$id, sub(value, /[bB][aA][sS][iI][cC][[:blank:]]/, ""));
+				local userpass = decode_base64_conn(c$id, sub(value, /[bB][aA][sS][iI][cC][[:blank:]]+/, ""));
 				local up = split_string(userpass, /:/);
 				if ( |up| >= 2 )
 					{
diff --git a/testing/btest/Baseline/scripts.base.protocols.http.http-basic-auth-extra-space/http.log b/testing/btest/Baseline/scripts.base.protocols.http.http-basic-auth-extra-space/http.log
new file mode 100644
index 0000000000..0acd48d84a
--- /dev/null
+++ b/testing/btest/Baseline/scripts.base.protocols.http.http-basic-auth-extra-space/http.log
@@ -0,0 +1,11 @@
+### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63.
+#separator \x09
+#set_separator	,
+#empty_field	(empty)
+#unset_field	-
+#path	http
+#open XXXX-XX-XX-XX-XX-XX
+#fields	ts	uid	id.orig_h	id.orig_p	id.resp_h	id.resp_p	trans_depth	method	host	uri	referrer	version	user_agent	origin	request_body_len	response_body_len	status_code	status_msg	info_code	info_msg	tags	username	password	proxied	orig_fuids	orig_filenames	orig_mime_types	resp_fuids	resp_filenames	resp_mime_types
+#types	time	string	addr	port	addr	port	count	string	string	string	string	string	string	string	count	count	count	string	count	string	set[enum]	string	string	set[string]	vector[string]	vector[string]	vector[string]	vector[string]	vector[string]	vector[string]
+XXXXXXXXXX.XXXXXX	CUM0KZ3MLUfNB0cl11	172.24.133.205	43090	172.24.133.205	8000	1	GET	172.24.133.205:8000	/	-	1.0	python-requests/2.31.0	-	0	643	200	OK	-	-	(empty)	test	1234	-	-	-	-	F2yF2x2UFyYsb6poSc	-	text/html
+#close XXXX-XX-XX-XX-XX-XX
diff --git a/testing/btest/Traces/http/basic-auth-with-extra-space.trace b/testing/btest/Traces/http/basic-auth-with-extra-space.trace
new file mode 100644
index 0000000000..5e37970992
Binary files /dev/null and b/testing/btest/Traces/http/basic-auth-with-extra-space.trace differ
diff --git a/testing/btest/scripts/base/protocols/http/http-basic-auth-extra-space.zeek b/testing/btest/scripts/base/protocols/http/http-basic-auth-extra-space.zeek
new file mode 100644
index 0000000000..9c0b52b1ec
--- /dev/null
+++ b/testing/btest/scripts/base/protocols/http/http-basic-auth-extra-space.zeek
@@ -0,0 +1,8 @@
+# Authorization: Basic is followed by two spaces rather than one.
+#
+# @TEST-EXEC: zeek -b -Cr $TRACES/http/basic-auth-with-extra-space.trace %INPUT
+# @TEST-EXEC: btest-diff http.log
+
+@load base/protocols/http
+
+redef HTTP::default_capture_password = T;