CVE-2025-25206: Mfa Enforcement Restricted To Local Authcve-2025-25206-mfa-enforcement-restricted-to-local-auth
The application explicitly limits MFA verification to instances where the authentication type is "local". Alternative mechanisms like LDAP, SAML, or External could bypass MFA unless every provider identically replicates the verification. Centralize MFA checks around the user object and session properties regardless of the initial authentication provider.
