A vulnerability in the Traefik HTTP reverse proxy allows unauthenticated attackers to perform user enumeration via timing side-channel attacks.

The flaw exists in the checkPassword function within the BasicAuth middleware, where concurrent requests for non-existent usernames create a measurable timing discrepancy compared to valid usernames. This allows an unauthenticated remote attacker to verify the existence of specific user accounts on the system.

Successful exploitation of this vulnerability facilitates user enumeration, which is a critical reconnaissance step for targeted credential stuffing or brute-force attacks. While the CVSS score of 6.3 identifies this as a medium-severity issue, the ability to map valid user accounts significantly lowers the bar for subsequent unauthorized access attempts, potentially leading to account takeover and data breach scenarios.

Immediate Action: Update Traefik to version 3.7.13 or later to incorporate the patch that ensures consistent timing for concurrent authentication requests.

Proactive Monitoring: Review access logs for patterns of high-frequency, concurrent login requests directed at the BasicAuth endpoint, which may indicate enumeration attempts.

Compensating Controls: Implement rate limiting or account lockout policies on the authentication interface to hinder the automated request volume required to exploit this timing discrepancy.

Public Exploit Available: Unknown

Security teams should prioritize updating Traefik to version 3.7.13 as part of routine maintenance. While this vulnerability does not allow for direct system compromise, it provides a valuable signal for attackers to focus their efforts on valid user accounts. Prompt patching is necessary to eliminate the information disclosure vector and protect user directory integrity.