Traefik versions before v2.11.56 and v3.7.12 do not fully canonicalize header names, treating X-Auth-User, X_Auth_User and X.Auth.User as separate headers. Backends that map header names to variables collapse these variations into a single variable, allowing a client to send an alias header that overrides the value set by Traefik’s ForwardAuth middleware. In a configuration test with PHP 8.2 over HTTP/1, the attacker’s alias value deterministically wins, enabling a low‑privilege user to be authenticated as a different role by the backend. This flaw permits authenticated identity spoofing for any header set by Traefik, not just those from ForwardAuth.

Traefik 1.x, 2.x up to and including 2.11.55, and 3.0.0 through 3.7.11 are affected. The fix is applied in Traefik 2.11.56 and 3.7.12, which introduce the aliasHeadersStrategy option; backwards compatibility, it must be explicitly set to ‘delete’ or ‘reject’ for the fix to take effect. Unmaintained release lines will not receive a patch.

The CVSS score of 5.3 indicates moderate severity. The EPSS score of < 1% suggests a low probability of exploitation. The vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is via the HTTP request headers that a client can supply; an attacker does not need to exploit a server side vulnerability beyond manipulating header names. Because the attacker’s supplied header wins deterministically under the affected configuration, the risk is that any server using these versions could be susceptible to identity spoofing with moderate effort. Unmaintained releases increase the potential exploitation window for older deployments.