--- a/src/PVE/AccessControl.pm
+++ b/src/PVE/AccessControl.pm
@@ -737,6 +737,7 @@
     my $plugin = PVE::Auth::Plugin->lookup($cfg->{type});
 
     if ($tfa_challenge) {
+	verify_ticket($tfa_challenge, 0, $username);
 	# This is the 2nd factor, use the password for the OTP response.
 	my $tfa_challenge = authenticate_2nd_new($username, $realm, $password, $tfa_challenge);
 	return wantarray ? ($username, $tfa_challenge) : $username;