diff --git a/routes/users.js b/routes/users.js
index 28855b6..cc37abc 100644
--- a/routes/users.js
+++ b/routes/users.js
@@ -153,7 +153,7 @@ router.put('/:id', upload.single('avatar'), async (req, res, next) => {
     if (Speakeasy.totp.verify({
       secret: user.totpSecret,
       encoding: 'base32',
-      token: parseInt(body.totp, 10),
+      token: parseInt(req.body.totp, 10),
       window: 0
     })) {
       user.update({ multifactorEnabled: true })