CVE-2026-88010 — Traefik: BasicAuth singleflight coalescing reintroduces an unauthenticated username-enumeration timing oracle

In Traefik’s BasicAuth middleware, the handling of concurrent requests allows an unauthenticated attacker to enumerate usernames based on timing. The impact is limited to username enumeration; no credential disclosure or authentication bypass is possible.