CVE-2026-63770 affects Glance through version 0.8.5. The vulnerability arises from the authentication handler trusting the leftmost value of the X-Forwarded-For HTTP header when the server proxied option is enabled. Attackers can supply arbitrary IP addresses in this header to circumvent per-IP failed-login counters, effectively bypassing brute-force lockout mechanisms. This enables unlimited credential guessing attempts without lockout, increasing the risk of unauthorized access.

The vulnerability allows unauthenticated attackers to bypass brute-force lockout protections by spoofing IP addresses in the X-Forwarded-For header. This can lead to unlimited login attempts against the authentication endpoint, increasing the likelihood of successful credential compromise. There is no indication of privilege escalation or other impacts beyond authentication bypass of brute-force protections.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, it is recommended to disable the server proxied option if feasible or implement additional rate-limiting controls that do not rely solely on the X-Forwarded-For header for IP-based lockout. Monitor vendor communications for patches or official mitigations.