diff --git a/core/Controller/AppPasswordController.php b/core/Controller/AppPasswordController.php
index 1dbeaa66a4599..9b015a1dd5d1a 100644
--- a/core/Controller/AppPasswordController.php
+++ b/core/Controller/AppPasswordController.php
@@ -16,6 +16,7 @@
 use OCP\AppFramework\Http\Attribute\ApiRoute;
 use OCP\AppFramework\Http\Attribute\BruteForceProtection;
 use OCP\AppFramework\Http\Attribute\NoAdminRequired;
+use OCP\AppFramework\Http\Attribute\NoTwoFactorRequired;
 use OCP\AppFramework\Http\Attribute\PasswordConfirmationRequired;
 use OCP\AppFramework\Http\Attribute\UseSession;
 use OCP\AppFramework\Http\DataResponse;
@@ -200,6 +201,7 @@ public function confirmUserPassword(string $password): DataResponse {
 	 *
 	 * @return DataResponse<Http::STATUS_OK, array{apppassword: string}, array{}>
 	 * @throws OCSForbiddenException Creating app password is not allowed
+	 * @NoTwoFactorRequired
 	 *
 	 * 200: App password returned
 	 */