Traefik versions before v2.11.56 and v3.7.12 do not fully canonicalize header names, treating X-Auth-User, X_Auth_User and X.Auth.User as separate headers. Backends that map header names to variables collapse these variations into a single variable, allowing a client to send an alias header that overrides the value set by Traefik’s ForwardAuth middleware. In a configuration test with PHP 8.2 over HTTP/1, the attacker’s alias value deterministically wins, enabling a low‑privilege user to be authenticated as a different role by the backend. This flaw permits authenticated identity spoofing for any header set by Traefik, not just those from ForwardAuth.

Traefik 1.x, 2.x up to and including 2.11.55, and 3.0.0 through 3.7.11 are affected. The fix is applied in Traefik 2.11.56 and 3.7.12, which introduce the aliasHeadersStrategy option that must be set to ‘delete’ or ‘reject’ for the vulnerability to be mitigated.

The CVSS metric for this vulnerability is 5.3, indicating moderate severity. EPSS data is not available, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is via the HTTP request headers that a client can supply; an attacker does not need to exploit a server side vulnerability beyond manipulating header names. Because the attacker’s supplied header wins deterministically under the affected configuration, the risk is that any server using these versions could be susceptible to identity spoofing with moderate effort. Undocumented or unmaintained releases will not receive a patch, increasing the potential exploitation window for older deployments.