CVE-2026-63770

Katalog CVE

CVSS 7.5 · High EPSS 0,30%

Kerentanan Use of Less Trusted Source. Skor CVSS 3.1 7.5 (High) menurut vulncheck.com.

Deskripsi (NVD)

Glance through 0.8.5 contains an IP address spoofing vulnerability in the authentication handler that allows unauthenticated attackers to bypass brute-force lockout protections by supplying arbitrary values in the X-Forwarded-For request header when the server proxied option is enabled. Attackers can manipulate the leftmost value of the X-Forwarded-For header to make each login attempt appear to originate from a distinct IP address, preventing the per-IP failed-login counter from reaching the lockout threshold and enabling unlimited credential guessing against the authentication endpoint.

Rincian

Terbit di NVD

20 Juli 2026

Terakhir diubah

21 Agustus 2026

Status NVD

Deferred

CVSS 3.1

7.5 (High), sumber vulncheck.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-348: Use of Less Trusted Source

EPSS (30 hari)

0,30% peluang dieksploitasi; lebih tinggi dari 20,5% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://github.com/glanceapp/glance/commit/3f20e8d9d0b1983892632649f35fd00c7b4ea8b6
• https://github.com/glanceapp/glance/issues/1031
• https://github.com/glanceapp/glance/pull/1033
• https://www.vulncheck.com/advisories/glance-ip-spoofing-authentication-brute-force-protection-bypass