A timing side-channel vulnerability exists in Traefik's BasicAuth middleware that allows attackers to enumerate valid usernames by measuring response time differences. The issue arises because a fallback secret intended for constant-time comparison is always empty, causing the comparison to short-circuit quickly and reveal timing differences between valid and invalid usernames. This vulnerability affects multiple versions of Traefik prior to fixed releases. A patch is available to address this issue.