Traefik’s BasicAuth middleware uses singleflight deduplication keyed by a concatenation of password and secret. A key collision in this mechanism allows an attacker who possesses a valid credential and the corresponding stored hash to authenticate as an unconfigured username when the middleware trusts the forwarded identity header. This flaw exemplifies an authentication mechanism bypass (CWE‑287) and an unsafe iteration/side‑effect weakness (CWE‑836), producing an authentication bypass that leads to identity spoofing.

Traefik versions 3.6.11 through 3.6.24 (inclusive) and 3.7.0 through 3.7.9 (inclusive) are vulnerable. The issue is fixed in Traefik 3.6.25 and 3.7.10.

The CVSS score of 2.1 categorizes the vulnerability as low severity, and EPSS score is below 1%. It is not listed in the CISA KEV catalog. Exploitation requires an attacker to have a valid credential and its stored hash, and to target a configuration that trusts forwarded identity headers. Under those conditions, the attacker can impersonate another user, potentially gaining unauthorized access to resources behind the reverse proxy. While the overall risk is low, environments with strict authentication controls may still consider applying the fix promptly.