diff --git a/core/modules/serialization/src/EventSubscriber/UserRouteAlterSubscriber.php b/core/modules/serialization/src/EventSubscriber/UserRouteAlterSubscriber.php
index 8f84eb54626..103e79a56d4 100644
--- a/core/modules/serialization/src/EventSubscriber/UserRouteAlterSubscriber.php
+++ b/core/modules/serialization/src/EventSubscriber/UserRouteAlterSubscriber.php
@@ -51,7 +51,7 @@ class UserRouteAlterSubscriber implements EventSubscriberInterface {
     ];
     $routes = $event->getRouteCollection();
     foreach ($route_names as $route_name) {
-      if ($route = $routes->get($route_name)) {
+      if (($route = $routes->get($route_name)) && $route->hasRequirement('_format')) {
         $formats = explode('|', $route->getRequirement('_format'));
         $formats = array_unique(array_merge($formats, $this->serializerFormats));
         $route->setRequirement('_format', implode('|', $formats));
diff --git a/core/modules/serialization/tests/modules/user_route_alter_test/src/Routing/RouteSubscriber.php b/core/modules/serialization/tests/modules/user_route_alter_test/src/Routing/RouteSubscriber.php
new file mode 100644
index 00000000000..e71144e4160
--- /dev/null
+++ b/core/modules/serialization/tests/modules/user_route_alter_test/src/Routing/RouteSubscriber.php
@@ -0,0 +1,37 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Drupal\user_route_alter_test\Routing;
+
+use Drupal\Core\Routing\RouteSubscriberBase;
+use Drupal\Core\Routing\RoutingEvents;
+use Symfony\Component\Routing\RouteCollection;
+
+/**
+ * Alter the 'user.pass.http' route.
+ */
+class RouteSubscriber extends RouteSubscriberBase {
+
+  /**
+   * {@inheritdoc}
+   */
+  protected function alterRoutes(RouteCollection $collection): void {
+    if ($route = $collection->get('user.pass.http')) {
+      $route->setRequirements([]);
+      $route->setRequirement('_access', 'FALSE');
+    }
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public static function getSubscribedEvents(): array {
+    $events = parent::getSubscribedEvents();
+    // Ensure this event is triggered before
+    // \Drupal\serialization\EventSubscriber\UserRouteAlterSubscriber.
+    $events[RoutingEvents::ALTER] = ['onAlterRoutes', 1];
+    return $events;
+  }
+
+}
diff --git a/core/modules/serialization/tests/modules/user_route_alter_test/user_route_alter_test.info.yml b/core/modules/serialization/tests/modules/user_route_alter_test/user_route_alter_test.info.yml
new file mode 100644
index 00000000000..9eca402af5b
--- /dev/null
+++ b/core/modules/serialization/tests/modules/user_route_alter_test/user_route_alter_test.info.yml
@@ -0,0 +1,4 @@
+name: 'User route alter test support'
+description: 'Provides test support for user route alter tests.'
+type: module
+version: VERSION
diff --git a/core/modules/serialization/tests/modules/user_route_alter_test/user_route_alter_test.services.yml b/core/modules/serialization/tests/modules/user_route_alter_test/user_route_alter_test.services.yml
new file mode 100644
index 00000000000..9358f6d8836
--- /dev/null
+++ b/core/modules/serialization/tests/modules/user_route_alter_test/user_route_alter_test.services.yml
@@ -0,0 +1,4 @@
+services:
+  _defaults:
+    autoconfigure: true
+  Drupal\user_route_alter_test\Routing\RouteSubscriber: ~
diff --git a/core/modules/serialization/tests/src/Kernel/UserRouteAlterTest.php b/core/modules/serialization/tests/src/Kernel/UserRouteAlterTest.php
new file mode 100644
index 00000000000..651e0b06f7b
--- /dev/null
+++ b/core/modules/serialization/tests/src/Kernel/UserRouteAlterTest.php
@@ -0,0 +1,46 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Drupal\Tests\serialization\Kernel;
+
+use Drupal\KernelTests\KernelTestBase;
+
+/**
+ * Tests that the user routes can be altered.
+ *
+ * @group serialization
+ */
+class UserRouteAlterTest extends KernelTestBase {
+
+  /**
+   * {@inheritdoc}
+   */
+  protected static $modules = [
+    'serialization',
+    'user',
+    'user_route_alter_test',
+  ];
+
+  /**
+   * Tests the altered 'user.login.http' route.
+   */
+  public function testUserAlteredRoute(): void {
+    /** @var \Drupal\Core\Routing\RouteProviderInterface $route_provider */
+    $route_provider = $this->container->get('router.route_provider');
+
+    // Ensure '_format' is set for the 'user.login.http' route.
+    $requirements = $route_provider->getRouteByName('user.login.http')->getRequirements();
+    $this->assertArrayHasKey('_format', $requirements, 'user.login.http route has "_format" requirement');
+    $this->assertEquals('json|xml', $requirements['_format'], 'user.login.http route "_format" requirement is "json|xml"');
+
+    // Ensure the '_access' requirement is set to FALSE for the 'user.pass.http'
+    // route.
+    $requirements = $route_provider->getRouteByName('user.pass.http')->getRequirements();
+    $this->assertArrayHasKey('_access', $requirements, 'user.pass.http route has "_access" requirement');
+    $this->assertEquals('FALSE', $requirements['_access'], 'user.pass.http route "_access" requirement is "FALSE"');
+    // Ensure '_format' is not set for the 'user.pass.http' route.
+    $this->assertArrayNotHasKey('_format', $requirements, 'user.pass.http route does not have "_format" requirement');
+  }
+
+}