Traefik’s BasicAuth middleware contains a timing side‑channel that allows an attacker to determine which usernames exist by measuring how quickly the authentication fails. The vulnerability arises because a variable intended to provide a constant‑time fallback secret resolves to an empty string, causing the comparison to short‑circuit instead of performing a full bcrypt hash operation. This flaw falls under CWE‑208. The attack does not provide direct code execution but gives an adversary valuable information that can accelerate credential‑guessing or social‑engineering attempts, thereby compromising confidentiality of user identities. Its impact is limited to the authentication layer and does not affect broader system stability or data integrity directly.

The issue affects Traefik releases prior to 2.11.43, 3.6.14, and 3.7.0‑rc.2. All earlier versions of the Traefik product are vulnerable; a safe path is to upgrade to one of the listed patched releases or later.

The CVSS score of 6.3 indicates a moderate severity. No EPSS score is available at present, and the vulnerability is not listed in CISA’s KEV catalog. Attackers can exploit the flaw over HTTP by sending authentication requests and measuring response times, requiring only network access to the proxied services. The lack of a publicly known exploit does not reduce the seriousness, as the enumeration capability can facilitate subsequent attacks. Prompt patching or mitigation is therefore advised.