The BasicAuth middleware in Traefik creates a significant timing difference between valid and invalid usernames, allowing an attacker to identify existing accounts without any credentials. This side‑channel vulnerability is classified as CWE-208 and can provide attackers with a list of valid usernames to target for further credential‑guessing or phishing attempts, thereby compromising the confidentiality of the system’s user data.

Traefik releases 2.11.40 and earlier, 3.0.0‑beta1 through 3.6.11, and the 3.7.0‑ea.1 early access build are affected. The product is distributed by Traefik Ltd and these particular version ranges contain the flaw.

With a CVSS score of 6.3 the vulnerability is of moderate severity and an EPSS score below 1 % indicates a low probability of exploitation. The flaw is not listed in the CISA KEV catalog, suggesting no widespread attacks are known. An unauthenticated attacker can trigger repeated HTTP requests to the BasicAuth‑protected route; the noticeable 298‑fold time difference enables reliable enumeration of valid usernames without needing privileged access or additional conditions.