您奇怪地将async/await与#混在一起，那么，坚持使用async/await可能会有所帮助:

const token = await safetyAttributesClass.generateAdminToken(email);
const email2 = await userRepository.getAllConfirmedEmails(email, token);
console.log("HIER STEHT DIE ZWEITE EMAIL-->", email2);

您应该在getAllConfirmedEmails回调中返回email2。 像这样

    app.post('/login', async (req, res) => {
            const { email } = req.body;
        
            // get safetyAttribues
            const safetyAttributes = await safetyAttributesClass.getSafetyAttributes(email);
        
            // if both are true, try to send login challenge
            if (safetyAttributes.isAccepted && safetyAttributes.isConfirmed) {
                if (safetyAttributes.isAdmin) {
                    const email2;
                     const token = await safetyAttributesClass.generateAdminToken(email).then(async (token)  => {
                         email2 = await userRepository.getAllConfirmedEmails(email, token)
                         
                    });
                    
                    
        
                }
                const user = userRepository.findByEmail(email);
                console.log('HIER ISTHEH <USJR', user);
                if (!user) {
                    return res.sendStatus(400);
                }
        
                const assertionChallenge = generateLoginChallenge(user.key);
                userRepository.updateUserChallenge(user, assertionChallenge.challenge);
        
                res.send(assertionChallenge);
            }
            // if not, send attributes to frontend to handle client-side
            else {
                res.send({ isAcceptet: safetyAttributes.isAccepted, isConfiremd: safetyAttributes.isConfirmed })
            }
        
        })

;