diff --git a/src/api/routes/auth/mfa/webauthn.ts b/src/api/routes/auth/mfa/webauthn.ts
index 8e6c5f039..3acd423e5 100644
--- a/src/api/routes/auth/mfa/webauthn.ts
+++ b/src/api/routes/auth/mfa/webauthn.ts
@@ -72,6 +72,7 @@ router.post(
 
         const securityKey = await SecurityKey.findOneOrFail({
             where: {
+                user_id: user.id,
                 key_id: Buffer.from(clientAttestationResponse.rawId, "base64url").toString("base64"),
             },
         });