Traefik's ForwardAuth middleware can be configured with trustForwardHeader=false and is deployed behind a trusted upstream proxy. In these circumstances a malicious actor can inject a spoofed X-Forwarded-Prefix header to bypass authentication checks, permitting access to resources without valid credentials. This flaw falls under CWE‑345, which represents implicit trust or access control weaknesses. The practical impact is an unauthorized privilege escalation that can compromise scope‑limited or system‑wide functionality depending on how the application is structured behind the proxy.

Affected versions include all releases of the Traefik HTTP reverse proxy and load balancer prior to 2.11.43, 3.6.14, and 3.7.0‑rc.2. Any deployment of these product versions that relies on ForwardAuth with trustForwardHeader set to false while sitting behind a trusted upstream proxy is susceptible.

The CVSS score of 7.8 indicates a high severity authentication bypass. EPSS data is not available, making precise exploitation likelihood uncertain, but authentication bypass typically represents a high risk to confidentiality and integrity. The driver for exploitation is HTTP header manipulation, so the attack vector is network‑based via crafted requests. The vulnerability is not currently listed in the CISA KEV catalog, implying no known active, widely‑publicised exploitation at this time.