diff --git a/core/middleware/password_expired.go b/core/middleware/password_expired.go
index 7432a73a8..911397bde 100644
--- a/core/middleware/password_expired.go
+++ b/core/middleware/password_expired.go
@@ -27,6 +27,7 @@ func PasswordExpired() gin.HandlerFunc {
 			c.Request.URL.Path == "/api/v2/core/settings/search" ||
 			c.Request.URL.Path == "/api/v2/core/settings/search/base" ||
 			c.Request.URL.Path == "/api/v2/core/xpack/settings/search" ||
+			c.Request.URL.Path == "/api/v2/core/xapp/verifyQRCode" ||
 			c.Request.URL.Path == "/api/v2/core/enterprise/users/info" ||
 			c.Request.URL.Path == "/api/v2/core/enterprise/licenses/info" ||
 			c.Request.URL.Path == "/api/v2/core/enterprise/licenses/status" ||