Which versions of Glance are affected by CVE-2026-63770?

Glance 0.8.5 contains an authentication brute-force protection bypass when the 'proxied' configuration option is enabled, allowing remote attackers to defeat per-IP login rate limiting by…

How to fix or mitigate CVE-2026-63770?

Within 24 hours, audit your Glance 0.8.5 deployment configuration to determine if the 'proxied' option is enabled; if disabled or not present, document that finding and no further action is needed for this CVE. If the option is enabled and not operationally critical, disable it immediately to eliminate the vulnerability window. If proxied mode is operationally required, configure your reverse proxy or WAF to strip all client-supplied X-Forwarded-For headers and replace them with the actual client connection IP from the trusted proxy layer only, then implement rate limiting rules at the proxy level keyed by username rather than per-IP. Within 7 days, audit authentication logs for suspicious failed login patterns indicative of brute-force attempts and review administrative account access history. Within 30 days, monitor the Glance GitHub repository (glanceapp/glance) and upstream security advisories for a vendor patch release; upgrade to the patched version immediately upon availability.

Glance CVE-2026-63770

Q: What is the CVSS score of CVE-2026-63770?

CVE-2026-63770 has a CVSS 4.0 base score of 8.2 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-46071 HIGH

Use of Less Trusted Source (CWE-348)

2026-07-20 disclosure@vulncheck.com

GHSA-jmgq-484h-mrfw

Authentication Bypass

8.2

CVSS 4.0 · Vendor: vulncheck

Severity by source

Vendor (vulncheck) PRIMARY

8.2 HIGH

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

5.9 MEDIUM

Network, unauthenticated, no UI; AC:H because the non-default proxied config precondition (AT:P in 4.0) has no direct 3.1 equivalent; C:H reflects credential compromise enabled by the lockout bypass, I/A none.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (vulncheck).

CVSS VectorVendor: vulncheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Jul 20, 2026 - 19:32 vuln.today

Analysis Generated

Jul 20, 2026 - 19:32 vuln.today

CVE Published

Jul 20, 2026 - 19:17 cve.org

HIGH 8.2

DescriptionCVE.org

Glance through 0.8.5 contains an IP address spoofing vulnerability in the authentication handler that allows unauthenticated attackers to bypass brute-force lockout protections by supplying arbitrary values in the X-Forwarded-For request header when the server proxied option is enabled. Attackers can manipulate the leftmost value of the X-Forwarded-For header to make each login attempt appear to originate from a distinct IP address, preventing the per-IP failed-login counter from reaching the lockout threshold and enabling unlimited credential guessing against the authentication endpoint.

AnalysisAI

Brute-force protection bypass in Glance (glanceapp/glance) 0.8.5 lets remote unauthenticated attackers defeat the per-IP failed-login lockout by rotating the leftmost value of the X-Forwarded-For header, but only when the server 'proxied' option is enabled. Because the authentication handler trusted the client-supplied leftmost XFF value instead of the trusted reverse proxy's rightmost value, each guess appears to come from a new IP and the lockout counter never trips, enabling unlimited credential guessing against the login endpoint. No public exploit identified at time of analysis and it is not in CISA KEV, though the upstream fix (PR #1033) and VulnCheck advisory make the technique trivially reproducible.

Technical ContextAI

Glance is a self-hosted dashboard/start-page application written in Go. The flaw is a classic CWE-348 (Use of Less Trusted Source): the addressOfRequest() helper in internal/glance/glance.go returned ips[0] - the leftmost X-Forwarded-For entry - as the client identity used for rate limiting. In a standard reverse-proxy deployment the leftmost XFF value is fully attacker-controlled and only the rightmost hop (appended by the trusted proxy) is reliable. The PR #1033 diff confirms the corrected behavior: it now trims and returns the last (rightmost) IP and falls back to RemoteAddr when the header is empty or malformed. The X-Forwarded-For dependence is only active when the Server.Proxied configuration flag is true; without proxied mode Glance uses RemoteAddr and the spoofing surface does not exist.

RemediationAI

Upstream fix available (PR/commit); released patched version not independently confirmed - apply the change from https://github.com/glanceapp/glance/pull/1033, which makes addressOfRequest() use the rightmost (trusted-proxy-appended) X-Forwarded-For value instead of the spoofable leftmost value, and upgrade to the first tagged release that includes this commit once published (verify against the project releases page). As an immediate compensating control on 0.8.5, disable the server 'proxied' option if the deployment does not actually require it - this reverts identity resolution to RemoteAddr and removes the spoofing surface, at the cost of losing real client IPs when Glance genuinely runs behind a proxy. Alternatively, terminate and strip/normalize the X-Forwarded-For header at the trusted reverse proxy (e.g., have nginx overwrite XFF with $remote_addr rather than appending) so downstream code cannot see client-supplied entries; the side effect is that any legitimately forwarded upstream chain is discarded. Reference the vendor advisory at https://www.vulncheck.com/advisories/glance-ip-spoofing-authentication-brute-force-protection-bypass.