diff --git a/modules/identityserver/src/Volo.Abp.IdentityServer.Domain/Volo/Abp/IdentityServer/AspNetIdentity/AbpResourceOwnerPasswordValidator.cs b/modules/identityserver/src/Volo.Abp.IdentityServer.Domain/Volo/Abp/IdentityServer/AspNetIdentity/AbpResourceOwnerPasswordValidator.cs
index acbbaa1f9b..81f2552e97 100644
--- a/modules/identityserver/src/Volo.Abp.IdentityServer.Domain/Volo/Abp/IdentityServer/AspNetIdentity/AbpResourceOwnerPasswordValidator.cs
+++ b/modules/identityserver/src/Volo.Abp.IdentityServer.Domain/Volo/Abp/IdentityServer/AspNetIdentity/AbpResourceOwnerPasswordValidator.cs
@@ -137,7 +137,9 @@ namespace Volo.Abp.IdentityServer.AspNetIdentity
                         var twoFactorCode = context.Request?.Raw?["TwoFactorCode"];
                         if (!twoFactorProvider.IsNullOrWhiteSpace() && !twoFactorCode.IsNullOrWhiteSpace())
                         {
-                            if (await UserManager.VerifyTwoFactorTokenAsync(user, twoFactorProvider, twoFactorCode))
+                            var providers = await UserManager.GetValidTwoFactorProvidersAsync(user);
+                            if (providers.Contains(twoFactorProvider) &&
+                                await UserManager.VerifyTwoFactorTokenAsync(user, twoFactorProvider, twoFactorCode))
                             {
                                 await SetSuccessResultAsync();
                                 return;