CVE-2026-63770
Received Received - Intake

IP Spoofing in Glance Authentication Handler

Publication date: 2026-07-20

Last updated on: 2026-07-20

Assigner: VulnCheck

Description
Glance through 0.8.5 contains an IP address spoofing vulnerability in the authentication handler that allows unauthenticated attackers to bypass brute-force lockout protections by supplying arbitrary values in the X-Forwarded-For request header when the server proxied option is enabled. Attackers can manipulate the leftmost value of the X-Forwarded-For header to make each login attempt appear to originate from a distinct IP address, preventing the per-IP failed-login counter from reaching the lockout threshold and enabling unlimited credential guessing against the authentication endpoint.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-20
Last Modified
2026-07-20
Generated
2026-07-21
AI Q&A
2026-07-20
EPSS Evaluated
N/A
NVD
CVE-2026-63770
EUVD
EUVD-2026-46071

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
glanceapp glance to 0.8.5 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-348 The product has two different sources of the same data or information, but it uses the source that has less support for verification, is less trusted, or is less resistant to attack.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in Glance through version 0.8.5 allows attackers to bypass brute-force protection by spoofing IP addresses. When the server is configured behind a proxy, attackers manipulate the X-Forwarded-For header to make each login attempt appear to come from a different IP. This prevents the system from locking out repeated failed login attempts, enabling unlimited credential guessing.

Detection Guidance

To detect this vulnerability, monitor for unusual login attempts where the X-Forwarded-For header contains multiple or spoofed IP addresses. Check Glance logs for repeated failed login attempts from varying IPs within short timeframes. Use network traffic analysis tools like tcpdump or Wireshark to inspect HTTP headers for X-Forwarded-For manipulation.

Impact Analysis

Attackers can exploit this to bypass login rate limits and perform unlimited password guessing attempts. If successful, they may gain full access to the Glance dashboard, exposing sensitive data like API keys, Docker container details, and internal service URLs. This is especially risky in self-hosted deployments with public login pages.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, which may violate compliance requirements under GDPR (data protection) and HIPAA (health information security) by exposing personal or protected health information through brute-force attacks.

Mitigation Strategies

Immediately update Glance to the latest version that includes the fix for CVE-2026-63770. If updating is not possible, disable the proxied mode in Glance configuration or implement network-level controls to block spoofed X-Forwarded-For headers. Configure your reverse proxy (e.g., nginx) to validate and sanitize incoming headers before forwarding requests to Glance.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-63770. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart