diff --git a/core/lib/Drupal/Core/Form/FormBuilder.php b/core/lib/Drupal/Core/Form/FormBuilder.php
index 4329188..435437c 100644
--- a/core/lib/Drupal/Core/Form/FormBuilder.php
+++ b/core/lib/Drupal/Core/Form/FormBuilder.php
@@ -842,7 +842,8 @@ public function doBuildForm($form_id, &$element, FormStateInterface &$form_state
       if ($form_state->isProgrammed() || (!empty($input) && (isset($input['form_id']) && ($input['form_id'] == $form_id)))) {
         $form_state->setProcessInput();
         if (isset($element['#token'])) {
-          if (!$form_state->hasValue('form_token') || !$this->csrfToken->validate($form_state->getValue('form_token'), $element['#token'])) {
+          $input = $form_state->getUserInput();
+          if (empty($input['form_token']) || !$this->csrfToken->validate($input['form_token'], $element['#token'])) {
             // Set an early form error to block certain input processing since
             // that opens the door for CSRF vulnerabilities.
             $url = $this->requestStack->getCurrentRequest()->getRequestUri();