An unauthenticated attacker can bypass route-level authentication and authorization in Traefik when `PathPrefix`-based public routes are used in combination with the `StripPrefix` middleware. By using a request path containing `..` or its percent-encoded form `%2e%2e`, a request can match a public route during the routing stage. After the prefix is stripped and the path is normalized, the request resolves to a protected path served by a separate authenticated router. This allows access to protected backend paths, such as admin or internal configuration endpoints, without satisfying the required authentication. This issue is caused by path normalization occurring after the prefix is stripped.