A critical authentication bypass vulnerability exists in Traefik's ForwardAuth and snippet-based authentication middleware due to incomplete sanitization of forwarded headers. Traefik only sanitizes canonical header names like 'X-Forwarded-Proto' but does not normalize or strip alias headers using underscores (e.g., 'X_Forwarded_Proto'). Attackers can exploit this by injecting spoofed trust context through these alias headers, bypassing authentication on protected routes without valid credentials. This issue arises from a mismatch between Traefik's header handling and downstream authentication services that normalize header names equivalently. Fixed versions are available in Traefik releases 2.11.43, 3.6.14, and 3.7.0-rc.2.