Traefik's ForwardAuth middleware can be configured with trustForwardHeader=false and is deployed behind a trusted upstream proxy. In these circumstances a malicious actor can inject a spoofed X-Forwarded-Prefix header to bypass authentication checks, permitting access to resources without valid credentials. This flaw falls under CWE‑345 and CWE‑501, which represent implicit trust or access control weaknesses. The practical impact is an unauthorized privilege escalation that can compromise scope‑limited or system‑wide functionality depending on how the application is structured behind the proxy.

Affected versions include all releases of the Traefik HTTP reverse proxy and load balancer prior to 2.11.43, 3.6.14, and 3.7.0‑rc.2. Any deployment of these product versions that relies on ForwardAuth with trustForwardHeader set to false while sitting behind a trusted upstream proxy is susceptible.

The CVSS score of 7.8 indicates a high severity authentication bypass. The EPSS score of 0.00017 indicates an extremely low probability of exploitation, consistent with the <1% threshold. Authentication bypass typically represents a high risk to confidentiality and integrity. The driver for exploitation is HTTP header manipulation, so the attack vector is network‑based via crafted requests. The vulnerability is not listed in the CISA KEV catalog, implying no known active, widely‑publicised exploitation at this time.