This vulnerability arises from the way Traefik’s BasicAuth middleware builds a singleflight key using the supplied password and stored secret. In versions 3.6.11 through 3.7.13, concurrent authentication attempts for non‑existent usernames collapse onto a single key, while attempts for real usernames trigger separate calculations. Because all attempts return the same error response, an attacker can measure the time difference between responses for nonexistent and existing usernames, revealing whether a username is present. The flaw does not disclose credentials or allow authentication bypass, but it provides an unauthenticated timing oracle that can aid credential‑guessing or reconnaissance.

Affected systems include installations of the Traefik reverse proxy and load balancer running versions 3.6.11 through 3.7.13 inclusive. The BasicAuth middleware is vulnerable, while Traefik v2 and Digest authentication are not affected.

The CVSS score of 6.3 reflects moderate risk, and the EPSS score is not available, making the current exploit likelihood uncertain. The vulnerability is not listed in the CISA KEV catalog; however, it is exploitable remotely via HTTP requests to the BasicAuth middleware, allowing an unauthenticated attacker to infer username existence through timing differences. Prompt remediation is recommended due to the potential impact on confidential user information and the ease of constructing the required requests.