diff --git a/koha-tmpl/intranet-tmpl/prog/en/modules/members/two_factor_auth.tt b/koha-tmpl/intranet-tmpl/prog/en/modules/members/two_factor_auth.tt
index a93144a46b..942740d3ff 100644
--- a/koha-tmpl/intranet-tmpl/prog/en/modules/members/two_factor_auth.tt
+++ b/koha-tmpl/intranet-tmpl/prog/en/modules/members/two_factor_auth.tt
@@ -68,6 +68,7 @@
                 <form id="two-factor-auth" action="/cgi-bin/koha/members/two_factor_auth.pl" method="post">
                     [% INCLUDE 'csrf-token.inc' %]
                     <input type="hidden" name="op" value="cud-disable-2FA" />
+                    <input type="hidden" name="borrowernumber" value="[% patron.id | html %]" />
                     <input type="submit" value="Disable two-factor authentication" />
                 </form>
             </div>
@@ -145,7 +146,7 @@
                     type: "POST",
                     url: "/api/v1/auth/two-factor/registration/verification",
                     success: function (data) {
-                        window.location = "/cgi-bin/koha/members/two_factor_auth.pl";
+                        window.location = "/cgi-bin/koha/members/two_factor_auth.pl?borrowernumber=[% patron.borrowernumber | url %]";
                     },
                     error: function (data) {
                         const error = data.responseJSON.error;
diff --git a/members/two_factor_auth.pl b/members/two_factor_auth.pl
index ec0d39c82d..307ab40d62 100755
--- a/members/two_factor_auth.pl
+++ b/members/two_factor_auth.pl
@@ -49,7 +49,7 @@ my $another_user = $patron_id ne $loggedinuser;
 
 my $logged_in_user = Koha::Patrons->find($loggedinuser);
 
-unless ( !$another_user || $logged_in_user->is_superlibrarian() ) {
+if ( $another_user && !$logged_in_user->is_superlibrarian() ) {
     print $cgi->redirect("/cgi-bin/koha/errors/403.pl");
     exit;
 }