diff --git a/plugins/portal/src/index.ts b/plugins/portal/src/index.ts
index 2ecde29cd..ef7dcf430 100644
--- a/plugins/portal/src/index.ts
+++ b/plugins/portal/src/index.ts
@@ -305,7 +305,7 @@ export function isPrivateNetworkUrl(raw: string): boolean {
   }
   if (url.protocol !== "http:" && url.protocol !== "https:") return false;
   const host = url.hostname.toLowerCase().replace(/^\[|\]$/g, "");
-  if (host === "localhost" || host.endsWith(".localhost")) return true;
+  if (host === "localhost" || host.endsWith(".localhost") || !host.includes(".")) return true;
   if (host.endsWith(".internal") || host.endsWith(".flycast") || host.endsWith(".local")) return true;
   if (/^127\.\d{1,3}\.\d{1,3}\.\d{1,3}$/.test(host) || /^10\.\d{1,3}\.\d{1,3}\.\d{1,3}$/.test(host)) return true;
   if (/^192\.168\.\d{1,3}\.\d{1,3}$/.test(host)) return true;
diff --git a/plugins/portal/test/broker-proxy.test.ts b/plugins/portal/test/broker-proxy.test.ts
index 495b934a4..4611fdbc9 100644
--- a/plugins/portal/test/broker-proxy.test.ts
+++ b/plugins/portal/test/broker-proxy.test.ts
@@ -184,6 +184,7 @@ test("isPrivateNetworkUrl admits only unroutable hosts", () => {
   for (const url of [
     "http://qm-auth.internal:8080",
     "http://qm-web-ui.flycast",
+    "http://auth:8080",
     "http://localhost:8099",
     "http://127.0.0.1:8099",
     "http://10.1.2.3:8080",