Traefik’s BasicAuth, DigestAuth, and ForwardAuth middlewares strip canonical‑cased spoofed identity headers before inserting their own values but ignore underscore‑variant header names. Many backend services normalize underscore and dash forms identically, so an attacker who can reach a protected route can inject an underscore‑variant header that passes through Traefik’s filtering. The header arrives at the backend in place of or alongside the intended authentication value, enabling the attacker to spoof user identity or modify the authorization context. The flaw aligns with CWE‑178, CWE‑290, and CWE‑345 and can lead to unauthorized access to protected resources.

The vulnerability affects all Traefik releases prior to v2.11.51, v3.6.22,Auth, or ForwardAuth middlewares are used. Deployments that rely on these authentication components are vulnerable until the corresponding versions are applied.

With a CVSS score of 7.8 the flaw is considered high severity. The EPSS is below 1 %, indicating a low likelihood of exploitation in the wild, and the vulnerability is not listing requires only the ability to send an HTTP request to a protected route;. The attacker can inject an underscore‑variant header directly into the request, resulting in identity spoofing or unauthorized authorization on downstream services that treat underscore and dash header names equivalently.