CVE-2026-53997 Details

A broken authentication vulnerability has been identified in Netherman Portal del Hermano (portaldelhermano.es) versions prior to 2026-10-06. The vulnerability exists in the password recovery process, specifically at the POST /password/create-access and POST /password/email endpoints. This flaw allows unauthenticated attackers to take over any member account across all tenants by exploiting the absence of rate limiting and the presence of distinct error messages that serve as oracles for each of the four identity verification factors: DNI, date of birth, phone number, and the last four digits of the IBAN. Attackers can confirm the validity of the DNI through the oracle, brute-force the date of birth and IBAN digits, gather the phone number using open-source intelligence, and then submit an email address of their choice to receive the password reset link. This process enables full account takeover, including access to profile data, complete IBAN information, and fiscal documents.

It is recommended to implement strict rate limiting on all identity verification endpoints, add CAPTCHA or similar anti-bot measures after failed attempts, and replace the multi-step verification process with an out-of-band method, such as sending a code via SMS or email.