diff --git a/core/Controller/CSRFTokenController.php b/core/Controller/CSRFTokenController.php
index c3d1a7f842b..4aa0d7fbb06 100644
--- a/core/Controller/CSRFTokenController.php
+++ b/core/Controller/CSRFTokenController.php
@@ -33,6 +33,8 @@ class CSRFTokenController extends Controller {
 	 *
 	 * 200: CSRF token returned
 	 * 403: Strict cookie check failed
+	 *
+	 * @NoTwoFactorRequired
 	 */
 	#[PublicPage]
 	#[NoCSRFRequired]