Log in / Sign up

Vulnerability details

CVE-2026-53997

NetHerman Portal del Hermano

Netherman Portal del Hermano Account Takeover via Password Reset Oracle

CVSS 4.0
9.1Critical

Official description

Netherman Portal del Hermano (portaldelhermano.es) before 2026-10-06 contains a broken authentication vulnerability in its password-recovery flow at the POST /password/create-access and POST /password/email endpoints, allowing unauthenticated attackers to take over any member account across all tenants by exploiting the lack of rate limiting and distinct error messages that act as oracles for each of the four identity-verification factors (DNI, date of birth, phone number, last four IBAN digits). Attackers can confirm the DNI via the oracle, brute-force the date of birth and IBAN digits, obtain the phone number through open-source intelligence, then submit an attacker-controlled email field so the password reset link is delivered to them, enabling full account takeover including profile data, full IBAN, and fiscal documents.

CVSS scores

ScoreVersionSourceVector
9.1Critical 4.0 CVEProject cvelistV5 (CNA) (VulnCheck) CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
7.4High 3.1 CVEProject cvelistV5 (CNA) (VulnCheck) CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Affected products

VendorProductVersionsSource
NetHerman Portal del Hermano (portaldelhermano.es) v < 2026-10-06 CVEProject cvelistV5 (CNA)

References and advisories

3
Kolun on Telegram @kolunsec Exploited CVEs, key news and a daily digest Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.

Details

Published
2026-10-13
Last updated
2026-10-15
State
Published
Assigner (CNA)
VulnCheck
Kolun priority
22 · Low

Exploit prediction (EPSS)

0.39%
Probability of exploitation in 30 days
34%
Percentile (among all CVEs)

SSVC assessment (CISA)

Automatable
No
Exploitation
None
Technical impact
Total

Weaknesses (CWE)

  • CWE-640
    Weak Password Recovery Mechanism for Forgotten Password
  • CWE-307
    Improper Restriction of Excessive Authentication Attempts