Product
A vulnerability in Glance through version 0.8.5 allows unauthenticated attackers to bypass brute-force lockout protections by manipulating the X-Forwarded-For HTTP header with arbitrary values, making each login attempt appear to originate from a distinct IP address when the server's proxied option is enabled, thereby enabling unlimited credential guessing against the authentication endpoint.