Multi-factor authentication is enforced for admin and CDE access

Password-only admin access means one phished or brute-forced credential hands an attacker complete administrative control. PCI DSS 4.0 Requirements 8.4 and 8.5 mandate multi-factor authentication for all access to the Cardholder Data Environment; NIST 800-53 rev5 IA-2(1) and IA-2(2) require MFA for privileged accounts. CWE-308 (Use of Single-Factor Authentication) and OWASP A07 both list missing MFA as a primary cause of privileged account compromise. A stolen admin password without a second factor exposes every user record, payment record, and configuration secret in the system.

Gate every admin route on a verified second factor — check factor enrollment before rendering the page, not just on login.

// src/app/admin/layout.tsx
import { redirect } from 'next/navigation'
import { createClient } from '@/utils/supabase/server'

export default async function AdminLayout({ children }: { children: React.ReactNode }) {
  const supabase = await createClient()
  const { data: { user } } = await supabase.auth.getUser()

  if (!user) redirect('/login')

  const { data } = await supabase.auth.mfa.getAuthenticatorAssuranceLevel()
  if (data?.currentLevel !== 'aal2') {
    redirect('/mfa-challenge')
  }

  return <>{children}</>
}

For Auth0 or Clerk, enable MFA enforcement in the provider dashboard and add a middleware check that validates the amr claim. Do not make MFA opt-in for admin roles — enforce enrollment before granting access.