Glances versions prior to 4.5.2 have a critical vulnerability in the Central Browser mode where the `/api/4/serverslist` endpoint exposes reusable downstream credentials via the `uri` field. When the front Glances Browser/API instance is started without a password, this endpoint is unauthenticated and returns server objects containing HTTP Basic authentication credentials derived from a pbkdf2 hash. These credentials can be accessed by any network user able to reach the API, potentially allowing unauthorized access to protected downstream Glances servers. The vulnerability is fixed in version 4.5.2.