CVE-2026-63770 in glance
Summary
by MITRE • 07/20/2026
Glance through 0.8.5 contains an IP address spoofing vulnerability in the authentication handler that allows unauthenticated attackers to bypass brute-force lockout protections by supplying arbitrary values in the X-Forwarded-For request header when the server proxied option is enabled. Attackers can manipulate the leftmost value of the X-Forwarded-For header to make each login attempt appear to originate from a distinct IP address, preventing the per-IP failed-login counter from reaching the lockout threshold and enabling unlimited credential guessing against the authentication endpoint.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 07/20/2026
The vulnerability in Glance version 0.8.5 represents a critical security flaw that undermines fundamental authentication controls through improper handling of proxy headers. This issue specifically affects the authentication handler component when the server is configured with the proxied option enabled, creating a pathway for attackers to circumvent essential security measures designed to prevent brute-force attacks. The vulnerability manifests through the manipulation of HTTP request headers, particularly the X-Forwarded-For header which is commonly used in web applications that operate behind load balancers or reverse proxies.
The technical exploitation relies on the application's failure to properly validate and sanitize the X-Forwarded-For header values before using them for access control decisions. When the server processes authentication requests, it incorrectly interprets the leftmost IP address value in this header as the genuine client IP address for rate-limiting purposes. This design flaw stems from a lack of proper input validation and trust boundary enforcement, where the application treats all header values as equally legitimate without verifying their authenticity or origin. The vulnerability directly maps to CWE-284 Access Control Issues and specifically manifests as an improper access control mechanism that allows unauthorized privilege escalation through spoofed client identity.
The operational impact of this vulnerability is severe as it effectively neutralizes all per-IP brute-force protection mechanisms within the authentication system. Attackers can continuously attempt credential guessing without fear of being locked out due to excessive failed login attempts, since each guess appears to come from a different IP address. This creates an unlimited window for credential stuffing, password spraying, and other automated attack vectors that would normally be blocked by standard rate-limiting protections. The vulnerability essentially provides attackers with a bypass mechanism that renders the authentication system's built-in protection mechanisms ineffective, potentially leading to account compromise and unauthorized system access.
Security mitigations for this vulnerability require immediate implementation of proper header validation and sanitization mechanisms within the authentication handler. Organizations should configure their applications to either ignore or properly validate X-Forwarded-For headers when used for access control decisions, implementing strict validation that ensures these headers originate from trusted proxy servers rather than allowing arbitrary values to influence security decisions. The recommended approach involves implementing a whitelist of trusted proxy IP addresses and validating that forwarded headers come exclusively from these known sources. Additionally, system administrators should consider implementing more robust authentication controls such as multi-factor authentication and adaptive access controls that can detect and respond to suspicious login patterns regardless of IP address spoofing attempts. This vulnerability aligns with ATT&CK technique T1110 Credential Access through Brute Force, where attackers leverage application-level flaws to bypass standard defensive measures that would normally protect against credential guessing attacks.
The broader implications of this vulnerability extend beyond immediate exploitation as it demonstrates a fundamental flaw in how proxy headers are handled within the authentication flow. This type of issue commonly appears in applications that fail to properly implement trust boundaries between different network layers, where external request data is not adequately validated before being used for security-sensitive decisions. Organizations should conduct comprehensive audits of their application's handling of proxy-related headers and implement consistent validation policies across all security-sensitive components. The vulnerability also highlights the importance of following secure coding practices that emphasize input sanitization and proper trust boundary enforcement, particularly in distributed systems where multiple network layers interact with application logic.