feat: add mfa guide

docs/guides/mfa.md

@@ -0,0 +1,41 @@
+# Multi-Factor Authentication (MFA)
+
+Multi-Factor Authentication (MFA) adds an extra security layer to your OpenCVE account. In addition to your password, you must confirm login with a one-time code (OTP).
+
+This is important for companies as it helps protect sensitive vulnerability data, even if a password is leaked or reused.
+
+## Enable MFA on your account
+
+To enable MFA, go to your account settings page: [https://app.opencve.io/settings/2fa/](https://app.opencve.io/settings/2fa/)
+
+![Activate MFA](../images/guides/mfa/activate-mfa.png){.center style="width:75%"}
+
+On this page:
+
+1. Click **Activate**.
+2. Scan the QR code with your authenticator app.
+3. Enter the OTP code shown by your app.
+4. Confirm activation.
+
+Once MFA is enabled, each new login will require your one-time OTP code.
+
+![MFA Validation](../images/guides/mfa/mfa-validation.png){.center style="width:50%"}
+
+## MFA Enforcement for organizations
+
+!!! warning "Enterprise Cloud only"
+
+    MFA Enforcement is available only on the **Enterprise plan** of the [OpenCVE.io](https://www.opencve.io) Cloud offering.
+
+Organization owners can enforce MFA for all members of their organization.
+
+To enable it:
+
+1. Go to your organization settings.
+2. Open the **General** tab.
+3. In the **MFA Enforcement** section, enable **Require MFA for all members**.
+4. Save your changes.
+
+![MFA Enforcement](../images/guides/mfa/mfa-enforcement.png){.center style="width:80%"}
+
+After MFA Enforcement is enabled, users who did not activate MFA can no longer browse OpenCVE pages. They are automatically redirected to the MFA activation page until MFA is enabled on their account.

mkdocs.yml

@@ -38,6 +38,7 @@ nav:
       - Migrate OpenCVE v1 data: 'guides/migrate_opencve_v1.md'
       - Report Summaries: 'guides/report_summaries.md'
       - Audit Logs: 'guides/audit_logs.md'
+      - Multi-Factor Authentication: 'guides/mfa.md'
       - SSO (SAML 2.0): 'guides/sso_saml2.md'
       - SMTP Configuration: 'guides/smtp_configuration.md'
   - API: