diff --git a/data/web/inc/ajax/qr_gen.php b/data/web/inc/ajax/qr_gen.php
index 1c543ebe8..a39c3f64e 100644
--- a/data/web/inc/ajax/qr_gen.php
+++ b/data/web/inc/ajax/qr_gen.php
@@ -7,7 +7,7 @@ if (!isset($_SESSION['mailcow_cc_role'])) {
 }
 
 if (isset($_GET['token']) && ctype_alnum($_GET['token'])) {
-  echo $tfa->getQRCodeImageAsDataUri($_SESSION['mailcow_cc_username'], $totp_secret);
+  echo $tfa->getQRCodeImageAsDataUri($_SESSION['mailcow_cc_username'], $_GET['token']);
 }
 
 ?>