Executive brief
Glance, a self-hosted dashboard application, contains a security flaw that allows attackers to bypass password protection limits. When the application is used behind a standard web proxy, an attacker can trick the system into thinking each login attempt is coming from a different person. This allows them to make unlimited password guesses without being locked out, potentially leading to unauthorized access to sensitive dashboard data and internal service information.
Technical details
An IP address spoofing vulnerability exists in the Glance authentication handler (internal/glance/glance.go) when the 'proxied' configuration option is enabled. The application's addressOfRequest function incorrectly trusts the leftmost value of the X-Forwarded-For HTTP header, which is client-controlled. By rotating this value in each request, an unauthenticated remote attacker can prevent the per-IP failed-login counter from reaching its lockout threshold. This enables unlimited brute-force credential guessing against the /api/authenticate endpoint. A fix has been proposed to use the rightmost (trusted proxy-appended) IP address instead.
Affected products
- glanceapp Glance <= 0.8.5
Timeline
- 2026-05-22: disclosed: Private disclosure to vendor
- 2026-06-30: other: Public issue opened on GitHub
- 2026-07-02: patched: Pull request submitted to fix the vulnerability
- 2026-07-20: advisory: CVE published and NVD record created