# CVE-2026-63770: Glance brute-force protection bypass via X-Forwarded-For spoofing

Source: https://junglewise.ai/threats/cve-2026-63770-glance-brute-force-protection-bypass-via-x-forwarded-for-spoofing  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-20. Updated: 2026-07-20  
License: CC BY 4.0 with a link back

CVE-2026-63770 · Severity: high · CVSS 7.5 · Published 2026-07-20

Glance, a self-hosted dashboard application, contains a security flaw that allows attackers to bypass password protection limits. When the application is used behind a standard web proxy, an attacker can trick the system into thinking each login attempt is coming from a different person. This allows them to make unlimited password guesses without being locked out, potentially leading to unauthorized access to sensitive dashboard data and internal service information.

## Quick answers

**Is CVE-2026-63770 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-63770 being exploited in the wild.

**How severe is CVE-2026-63770?** High severity, with a CVSS score of 7.5, published 20 July 2026.

**Which products and versions are affected?** glanceapp Glance <= 0.8.5.

**Is there a fix for CVE-2026-63770?** A patch was published on 2026-07-02: Pull request submitted to fix the vulnerability Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-63770 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-63770?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An IP address spoofing vulnerability exists in the Glance authentication handler (internal/glance/glance.go) when the 'proxied' configuration option is enabled. The application's addressOfRequest function incorrectly trusts the leftmost value of the X-Forwarded-For HTTP header, which is client-controlled. By rotating this value in each request, an unauthenticated remote attacker can prevent the per-IP failed-login counter from reaching its lockout threshold. This enables unlimited brute-force credential guessing against the /api/authenticate endpoint. A fix has been proposed to use the rightmost (trusted proxy-appended) IP address instead.

## Affected products

- glanceapp Glance <= 0.8.5

## Timeline

- 2026-05-22: disclosed: Private disclosure to vendor
- 2026-06-30: other: Public issue opened on GitHub
- 2026-07-02: patched: Pull request submitted to fix the vulnerability
- 2026-07-20: advisory: CVE published and NVD record created

## References

- [https://github.com/glanceapp/glance/issues/1031](https://github.com/glanceapp/glance/issues/1031)
- [https://github.com/glanceapp/glance/pull/1033](https://github.com/glanceapp/glance/pull/1033)
- [https://www.vulncheck.com/advisories/glance-ip-spoofing-authentication-brute-force-protection-bypass](https://www.vulncheck.com/advisories/glance-ip-spoofing-authentication-brute-force-protection-bypass)