Netherman Portal del Hermano Flaw Allows Unauthenticated Account Takeovers
A critical broken authentication flaw in Netherman Portal del Hermano lets attackers hijack accounts by exploiting error messages and missing rate limits.
Key points
- CVE-2026-53997 is rated 9.1 Critical on the CVSS scale by the National Vulnerability Database.
- The flaw affects Netherman Portal del Hermano versions released before October 6, 2026.
- Attackers can bypass authentication using distinct error messages as oracles for identity verification factors.
Netherman Portal del Hermano contains a critical broken authentication vulnerability that allows unauthenticated attackers to take over member accounts across all tenants. The National Vulnerability Database assigned CVE-2026-53997 a CVSS score of 9.1, classifying the issue as critical. The flaw exists in the password-recovery flow of the portal.
At a glance
- CVE
- CVE-2026-53997
- Product
- NetHerman Portal del Hermano (portaldelhermano.es)
- CVSS
- 9.1 Critical
- Weakness
- CWE-640, CWE-307
- Exploited
- No known exploitation
The vulnerability resides in the POST /password/create-access and POST /password/email endpoints. According to the NVD record, the lack of rate limiting and distinct error messages act as oracles for four identity-verification factors. These factors include the DNI, date of birth, phone number, and the last four digits of the IBAN. Attackers can exploit these responses to confirm valid data step by step.
Context and Background
The attack methodology relies on the application revealing specific validation errors for each identity factor. An attacker can first confirm a target's DNI using the oracle response. They can then brute-force the date of birth and the last four IBAN digits. The NVD description notes that attackers can obtain the phone number through open-source intelligence. This combination of data allows them to bypass the intended security controls.
Once the identity factors are verified, the attacker submits an attacker-controlled email field. The system then delivers the password reset link to this controlled email address. This enables full account takeover for the targeted member. The flaw affects versions of Netherman Portal del Hermano released before October 6, 2026.
Who Is Affected
Organizations using Netherman Portal del Hermano prior to the October 6, 2026 update are affected by this vulnerability. The flaw allows account takeover across all tenants hosted on the platform. Successful exploitation grants attackers access to sensitive profile data. Attackers can also retrieve full IBAN details and fiscal documents associated with the compromised accounts.
The weaknesses are categorized under CWE-640 and CWE-307. These common weakness enumerations relate to authentication issues and insufficient verification. The NVD record does not mention any confirmed patches or fixes available at this time. Users of the affected software should monitor for vendor updates.
What should you do?
Security teams should verify their current version of Netherman Portal del Hermano against the October 6, 2026 cutoff. If the software is older, the organization is vulnerable to the described account takeover attack. Administrators should review logs for unusual activity on the password recovery endpoints. Look for high volumes of requests to POST /password/create-access and POST /password/email.
What to do and how to stay safe: Netherman
- Audit your Netherman Portal del Hermano version to determine if it predates October 6, 2026.
- Monitor server logs for excessive traffic on password recovery endpoints, which may indicate brute-force attempts.
- Restrict access to the portal endpoints using IP whitelisting or additional authentication layers if possible.
- Wait for the vendor to release an official update or patch before applying unofficial modifications.
Step-by-step guide: Risk Based Vulnerability Management: Prioritize Fixes by Actual Threat
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVSS score for CVE-2026-53997?
The National Vulnerability Database rates CVE-2026-53997 as 9.1, which is classified as Critical.
Which endpoints are vulnerable to this attack?
The POST /password/create-access and POST /password/email endpoints contain the broken authentication vulnerability.
Is there a patch available for this flaw?
The source material does not confirm the availability of a fix or patch for this vulnerability.
