Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-53997— Netherman Portal del Hermano Account Takeover via Password Reset Oracle

Quick assessment

Affected
NetHerman Portal del Hermano (portaldelhermano.es)
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在2026年10月6日之前发布的Netherman Portal del Hermano（portaldelhermano.es）存在一个身份验证缺陷漏洞，该漏洞位于其密码恢复流程中的POST /password/create-access和POST /password/email端点。由于缺乏速率限制，并且针对四种身份验证因子（DNI、出生日期、电话号码、IBAN后四位）返回不同的错误消息，攻击者可以利用这些差异作为信息泄露源，从而接管所有租户中的任意成员账户。 攻击者首先可通过错误消息确认DNI的有效性，随后暴

CVSS 7.4 · High EPSS 0.40% · P32

Affected Version Matrix 1

VendorProduct Version RangeStatus
NetHerman Portal del Hermano (portaldelhermano.es) < 2026-10-06 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-53997

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Netherman Portal del Hermano Account Takeover via Password Reset Oracle
Source: CVE Program / CVE List V5
Vulnerability Description
Netherman Portal del Hermano (portaldelhermano.es) before 2026-10-06 contains a broken authentication vulnerability in its password-recovery flow at the POST /password/create-access and POST /password/email endpoints, allowing unauthenticated attackers to take over any member account across all tenants by exploiting the lack of rate limiting and distinct error messages that act as oracles for each of the four identity-verification factors (DNI, date of birth, phone number, last four IBAN digits). Attackers can confirm the DNI via the oracle, brute-force the date of birth and IBAN digits, obtain the phone number through open-source intelligence, then submit an attacker-controlled email field so the password reset link is delivered to them, enabling full account takeover including profile data, full IBAN, and fiscal documents.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
忘记口令恢复机制弱
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
NetHerman Portal del Hermano (portaldelhermano.es) 0 ~ 2026-10-06 -

II. Public POCs for CVE-2026-53997

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-53997

请登录查看更多情报信息。

News Coverage for CVE-2026-53997 (2)

Vendor Pages for CVE-2026-53997 (1)

IV. Related Vulnerabilities

Same weakness: CWE-640

V. Comments for CVE-2026-53997

No comments yet

Leave a comment