diff --git a/files/routes/login.py b/files/routes/login.py
index c9ed6f87d..65ae2866a 100644
--- a/files/routes/login.py
+++ b/files/routes/login.py
@@ -463,7 +463,7 @@ def post_reset(v):
 @app.get("/lost_2fa")
 @auth_desired
 def lost_2fa(v):
-
+	if v and not v.mfa_token: abort(400, "You don't have a 2FA token")
 	return render_template(
 		"lost_2fa.html",
 		v=v