Glance’s authentication handler allows attackers to circumvent brute‑force lockout protection by injecting arbitrary IP addresses into the X‑Forwarded‑For HTTP header. When the server proxy option is enabled, the leftmost value of this header is treated as the client’s IP. An unauthenticated user can rotate that value on each login attempt, causing the per‑IP failure counter never to reach its threshold. The result is that an attacker can perform unlimited credential guessing against the authentication endpoint. This issue is classified as CWE‑348.

The vulnerability affects the Glance application, specifically version 0.8.5 or earlier, when the server proxy feature is enabled and the X‑Forwarded‑For header is processed. Running without the proxy or disabling header processing eliminates the vulnerability.

The CVSS score of 8.2 indicates high severity. The EPSS score of < 1% suggests a very low but non‑zero probability of exploitation, while the vulnerability is not listed in the CISA KEV catalog. The attack vector is an HTTP request with a crafted X‑Forwarded‑For header sent to the authentication endpoint; if an attacker can reach this endpoint, the exploit can be applied with minimal effort, allowing an attacker to bypass lockout and conduct extensive credential‑guessing.