So in K9 the passcode is just 5 digits...
https://docs.kentico.com/k9/custom-development/handling-global-events/handling-custom-multi-factor-authentication
But in K11, the passcode is using the default 6 digits...
https://docs.kentico.com/k11/custom-development/handling-global-events/handling-custom-multi-factor-authentication
Once I removed the substring in my code, I was able to log in to the CMS with the passcode successfully.