Key points
- CVE-2026-53997 is rated Critical with a CVSS score of 9.1.
- The vulnerability affects Netherman Portal del Hermano versions prior to October 6, 2026.
- Attackers can take over accounts by brute-forcing identity verification factors.
The Netherman Portal del Hermano contains a critical broken authentication vulnerability that allows unauthenticated attackers to hijack member accounts. According to the National Vulnerability Database, this flaw, tracked as CVE-2026-53997, exists in versions of the software released before October 6, 2026. The issue stems from inadequate security controls within the password recovery workflow.
Technical details of the exploit
The vulnerability resides in the POST /password/create-access and POST /password/email endpoints. Attackers exploit the absence of rate limiting and the presence of distinct error messages that act as oracles for identity verification. These error responses reveal whether specific input data matches the target’s records. The system validates four factors: DNI, date of birth, phone number, and the last four digits of the IBAN.
An attacker can confirm the DNI using the oracle mechanism. They can then brute-force the date of birth and the IBAN digits because the application provides immediate feedback on correctness. The phone number can often be obtained through open-source intelligence. Once these factors are confirmed, the attacker submits a controlled email address.
Scope of the compromise
This flaw affects all tenants using the Netherman Portal del Hermano. The successful exploitation enables full account takeover. Attackers gain access to profile data, the full IBAN, and fiscal documents. The National Vulnerability Database classifies the weaknesses as CWE-640 and CWE-307. The CVSS score of 9.1 indicates a critical severity level due to the ease of exploitation and the high impact on confidentiality.
Next steps
Organizations using Netherman Portal del Hermano must verify their version immediately. If the software version is prior to the October 6, 2026 release, it is vulnerable. Administrators should check for updates from the vendor to address CVE-2026-53997. Until a patch is confirmed, monitoring for unusual password reset activity is advisable.
What to do and how to stay safe: Netherman Portal
- Verify the current version of Netherman Portal del Hermano against the October 6, 2026 cutoff date.
- Monitor logs for repeated failed attempts on password recovery endpoints.
- Implement additional rate limiting on authentication endpoints if possible.
- Watch for alerts regarding the release of a vendor patch for CVE-2026-53997.
Step-by-step guide: Emergency Patching Checklist for Critical System Fixes
General security guidance from the SecOps Monitor newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVSS score for CVE-2026-53997?
The National Vulnerability Database rates CVE-2026-53997 as Critical with a CVSS score of 9.1.
Which endpoints are affected by this vulnerability?
The POST /password/create-access and POST /password/email endpoints are affected by the broken authentication flaw.
Can attackers access sensitive financial data through this exploit?
Yes, successful exploitation allows attackers to access profile data, full IBANs, and fiscal documents.
