diff --git a/core/Controller/TwoFactorChallengeController.php b/core/Controller/TwoFactorChallengeController.php
index fd4811d3ff675..9f379ad30d7e9 100644
--- a/core/Controller/TwoFactorChallengeController.php
+++ b/core/Controller/TwoFactorChallengeController.php
@@ -143,6 +143,8 @@ public function showChallenge($challengeProviderId, $redirect_url) {
 	 * @NoCSRFRequired
 	 * @UseSession
 	 *
+	 * @UserRateThrottle(limit=5, period=100)
+	 *
 	 * @param string $challengeProviderId
 	 * @param string $challenge
 	 * @param string $redirect_url