CVE-2026-63770 affects Glance through version 0.8.5. The vulnerability arises from the use of the X-Forwarded-For HTTP header in the authentication handler when the server proxied option is enabled. Attackers can supply arbitrary values in this header to spoof IP addresses, circumventing the per-IP failed-login attempt counter. This allows unauthenticated attackers to bypass brute-force lockout protections and perform unlimited credential guessing against the authentication endpoint. The CVSS 4.0 score is 8.2, indicating high severity with network attack vector, low attack complexity, and no privileges or user interaction required.

Successful exploitation allows unauthenticated attackers to bypass brute-force lockout protections by spoofing IP addresses via the X-Forwarded-For header. This enables unlimited credential guessing attempts against the authentication endpoint, increasing the risk of unauthorized access through credential compromise.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround is currently documented. Until a patch is available, consider disabling the server proxied option if feasible or implementing additional authentication rate-limiting controls that do not rely solely on IP address tracking.