diff -up evolution-data-server-3.28.5/src/libedataserver/e-data-server-util.c.cve-2019-3890 evolution-data-server-3.28.5/src/libedataserver/e-data-server-util.c
--- evolution-data-server-3.28.5/src/libedataserver/e-data-server-util.c.cve-2019-3890	2019-04-15 09:25:49.273786456 +0200
+++ evolution-data-server-3.28.5/src/libedataserver/e-data-server-util.c	2019-04-15 09:35:00.784778830 +0200
@@ -3147,11 +3147,13 @@ e_util_can_use_collection_as_credential_
 				if (can_use_collection) {
 					gchar *method_source, *method_collection;
 
-					/* Also check the method; if different, then rather not use the collection */
+					/* Also check the method; if different, then rather not use the collection.
+					   Consider 'none' method on the child as the same as the collection method. */
 					method_source = e_source_authentication_dup_method (auth_source);
 					method_collection = e_source_authentication_dup_method (auth_collection);
 
 					can_use_collection = !method_source || !method_collection ||
+						g_ascii_strcasecmp (method_source, "none") == 0 ||
 						g_ascii_strcasecmp (method_source, method_collection) == 0;
 
 					g_free (method_source);