CVE-2026-63770 Details
Description
Glance through 0.8.5 contains an IP address spoofing vulnerability in the authentication handler that allows unauthenticated attackers to bypass brute-force lockout protections by supplying arbitrary values in the X-Forwarded-For request header when the server proxied option is enabled. Attackers can manipulate the leftmost value of the X-Forwarded-For header to make each login attempt appear to originate from a distinct IP address, preventing the per-IP failed-login counter from reaching the lockout threshold and enabling unlimited credential guessing against the authentication endpoint.
A vulnerability in Glance version 0.8.5 allows unauthenticated attackers to bypass authentication rate limits by spoofing IP addresses in the X-Forwarded-For header. This is possible when the server proxied option is enabled, as recommended for reverse proxy deployments. Attackers can manipulate the leftmost value of the X-Forwarded-For header to make each login attempt appear to come from a different IP address, preventing the per-IP failed login counter from reaching the lockout threshold. This exploitation allows for unlimited credential guessing on the authentication endpoint.
Users can update to the latest version of Glance, where this vulnerability has been addressed. The official Glance repository on GitHub contains the latest release.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 20, 2026CISA-ADP
Assessed Jul 23, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/glanceapp/glance/commit/3f20e8d9d0b1983892632649f35fd00c7b4ea8b6 | [email protected] | |
| https://github.com/glanceapp/glance/issues/1031 | [email protected] | Issue TrackingTechnical DescriptionVendor |
| https://github.com/glanceapp/glance/pull/1033 | [email protected] | Issue TrackingVendor |
| https://www.vulncheck.com/advisories/glance-ip-spoofing-authentication-brute-force-protection-bypass | [email protected] | Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-348 | Use of Less Trusted Source | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Glance | <= 0.8.5 (semver) |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 21, 2026 | CVE Modified | [email protected] |
| Jul 23, 2026 | CVE Modified | CISA-ADP |
| Jul 20, 2026 | New CVE Received | [email protected] |