A timing side-channel vulnerability in Traefik's BasicAuth middleware on the v3.6 line allows unauthenticated attackers to enumerate valid usernames under concurrent request conditions. The issue arises from how concurrent credential checks are coalesced using a singleflight.Group key that depends on stored secrets, causing different timing responses for existing versus non-existent usernames. This vulnerability does not allow credential disclosure or authentication bypass. The flaw affects Traefik versions from 3.6.11 up to but not including 3.7.13. The vulnerability has been fixed in version 3.7.13.