Traefik's ForwardAuth middleware has a critical authentication bypass vulnerability when configured with trustForwardHeader=false and deployed behind a trusted upstream proxy. The vulnerability arises because the X-Forwarded-Prefix header is not stripped or rebuilt, allowing an attacker to spoof this header and bypass authentication if the auth service relies on it for authorization decisions. This can lead to unauthorized access to protected backend routes. The issue affects multiple versions of Traefik prior to fixed releases and has been confirmed with a CVSS score of 10.0.