diff --git a/app/controllers/users_controller.rb b/app/controllers/users_controller.rb
index cb88f94fbba..61507d2c0d6 100644
--- a/app/controllers/users_controller.rb
+++ b/app/controllers/users_controller.rb
@@ -592,7 +592,7 @@ class UsersController < ApplicationController
         end
 
         email_token_user = EmailToken.confirmable(token)&.user
-        totp_enabled = email_token_user.totp_enabled?
+        totp_enabled = email_token_user&.totp_enabled?
         second_factor_token = params[:second_factor_token]
         confirm_email = false