Traefik's handling of HTTP headers allows a client to supply a dot-form alias header (e.g., X.Authenticated.User) that bypasses ForwardAuth middleware's identity replacement. Go's HTTP header canonicalization treats headers with dashes, underscores, and dots as distinct, but backends like PHP collapse these into the same environment variable, causing the client-supplied value to override the authenticated identity. This vulnerability affects Traefik v1.x, all v2 releases before 2.11.56, and v3 releases from 3.0.0 up to 3.7.11. The issue is a sibling to a previous GHSA advisory that blocked underscore aliases but did not address dot aliases. The fix involves setting the new aliasHeadersStrategy option to 'delete' or 'reject' and upgrading to patched versions.

An attacker permitted by ForwardAuth with a lower-privilege identity can supply a dot-form alias header to impersonate another user or administrative role, potentially compromising confidentiality and integrity of backend applications. The vulnerability was verified with PHP 8.2.27 and 8.2.33 backends. It does not bypass ForwardAuth denial but allows identity spoofing after authentication.

A fix is available in Traefik versions 2.11.56 and 3.7.12. Users should upgrade to these versions or later and explicitly set the aliasHeadersStrategy option to 'delete' or 'reject' to prevent header alias spoofing. Unmaintained versions will not receive patches and should be upgraded. This mitigation addresses the issue by removing or rejecting alias headers that could be used for spoofing.