diff --git a/app/controllers/shared/api.php b/app/controllers/shared/api.php
index 7c2f08c70..fdaa98212 100644
--- a/app/controllers/shared/api.php
+++ b/app/controllers/shared/api.php
@@ -290,7 +290,7 @@ App::init()
             $minimumFactors = ($mfaEnabled && $hasMoreFactors) ? 2 : 1;
 
             if (!in_array('mfa', $route->getGroups())) {
-                if ($session && \count($session->getAttribute('factors')) < $minimumFactors) {
+                if ($session && \count($session->getAttribute('factors', [])) < $minimumFactors) {
                     throw new Exception(Exception::USER_MORE_FACTORS_REQUIRED);
                 }
             }