fixed: Normally it should be safe to assume that the GlobalConfig is never null. GlobalConfigurations are singletons that are instantiated a Jenkins start. Though I'm not sure if it could happen that it is null when access a url while Jenkins is starting. So probably better to just return when it is null. The follow-up null checks are not needed

src/main/java/io/jenkins/plugins/MfaFilter.java

@@ -67,30 +67,25 @@ public class MfaFilter implements Filter {
         }
 
         User user = User.current();
-        if (user == null) {
+        MfaGlobalConfig globalConfig = GlobalConfiguration.all().get(MfaGlobalConfig.class);
+
+        if (user == null || globalConfig == null) {
             chain.doFilter(request, response);
             return;
         }
 
-        MfaGlobalConfig globalConfig = GlobalConfiguration.all().get(MfaGlobalConfig.class);
-        if (globalConfig == null) {
-            LOGGER.warning("MfaGlobalConfig not found - using default settings");
-            globalConfig = new MfaGlobalConfig();
+        // Check if it is a tokenized API call (if the option is enabled)
+        if (globalConfig.isExcludeApiTokens() && isApiTokenRequest(req)) {
+            chain.doFilter(request, response);
+            return;
         }
 
         MfaUserProperty mfa = user.getProperty(MfaUserProperty.class);
 
-        boolean mfaRequired =
-                (mfa != null && mfa.isMfaEnabled()) || (globalConfig != null && globalConfig.isEnforceMfaForAllUsers());
+        boolean mfaRequired = (mfa != null && mfa.isMfaEnabled()) || globalConfig.isEnforceMfaForAllUsers();
 
         if (mfaRequired) {
 
-            // Check if it is a tokenized API call (if the option is enabled)
-            if (globalConfig != null && globalConfig.isExcludeApiTokens() && isApiTokenRequest(req)) {
-                chain.doFilter(request, response);
-                return;
-            }
-
             boolean verified = req.getSession() != null
                     && Boolean.TRUE.equals(req.getSession().getAttribute("mfa-verified"));