CVE-2026-41263: Traefik: A timing side-channel vulnerability allows for valid username enumeration via BasicAuth middleware

There is a timing side-channel vulnerability in Traefik’s BasicAuth middleware that allows an attacker to enumerate valid usernames through response-time differences.

The variable intended to hold a constant-time fallback secret always resolves to an empty string, causing the constant-time comparison to short-circuit in microseconds rather than performing a full bcrypt evaluation. This restores the original timing oracle and makes it possible to distinguish existing users from non-existing ones by measuring authentication response times.