Traefik, an open-source HTTP reverse proxy and load balancer, contains a flaw in its ForwardAuth feature that allows a client to supply a dot-form header (for example X.Authenticated.User). Because Go treats this header as distinct from the expected X-Authenticated-User, the header remains during the ForwardAuth replacement process when underscoreHeadersStrategy is used. Backends that interpret CGI, WSGI, PHP, or NGINX conventions collapse the dot-form and hyphenated header names, meaning the backend can accept the client-supplied value instead of the identity that Traefik asserted, resulting in the attacker successfully spoofing the authenticated identity for any header managed by Traefik.

Traefik version 2.* before 2.11.56 and versions 3.0.0 through 3.7.12 are affected. Users of Traefik 2.11.56 or later, and 3.7.12 or later, benefit from a mitigation that removes the vulnerability.

The flaw has a CVSS base score of 5.3, indicating moderate risk. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog. It dot‑form header in an HTTP request, exploiting the mismatch between Go’s header normalization and downstream backend frameworks that collapse header names. Since the attacker does not need elevated privileges or authentication to the proxy, the attack vector is likely external and requires only normal HTTP traffic to the Traefik instance.