NetHerman Portal del Hermano prior 2026-10-06 Password Recovery Flow /password/create-access email password recovery

Summaryinfo

A vulnerability labeled as critical has been found in NetHerman Portal del Hermano. Impacted is an unknown function of the file /password/create-access of the component Password Recovery Flow. Such manipulation of the argument email leads to password recovery. This vulnerability is traded as CVE-2026-53997. The attack may be launched remotely. There is no exploit available. This product is a managed service, which means users themselves cannot handle vulnerability countermeasures. The affected component should be upgraded.

Detailsinfo

A vulnerability, which was classified as critical, has been found in NetHerman Portal del Hermano. Affected by this issue is an unknown part of the file /password/create-access of the component Password Recovery Flow. The manipulation of the argument email with an unknown input leads to a password recovery vulnerability. Using CWE to declare the problem leads to CWE-640. The product contains a mechanism for users to recover or change their passwords without knowing the original password, but the mechanism is weak. Impacted is confidentiality, integrity, and availability. CVE summarizes:

Netherman Portal del Hermano (portaldelhermano.es) before 2026-10-06 contains a broken authentication vulnerability in its password-recovery flow at the POST /password/create-access and POST /password/email endpoints, allowing unauthenticated attackers to take over any member account across all tenants by exploiting the lack of rate limiting and distinct error messages that act as oracles for each of the four identity-verification factors (DNI, date of birth, phone number, last four IBAN digits). Attackers can confirm the DNI via the oracle, brute-force the date of birth and IBAN digits, obtain the phone number through open-source intelligence, then submit an attacker-controlled email field so the password reset link is delivered to them, enabling full account takeover including profile data, full IBAN, and fiscal documents.

The advisory is shared for download at beafn28.es. This vulnerability is handled as CVE-2026-53997 since 06/11/2026. The exploitation is known to be easy. The attack may be launched remotely. No form of authentication is required for exploitation. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1552.

Upgrading to version 2026-10-06 eliminates this vulnerability.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Vendor

• NetHerman

Name

• Portal del Hermano

Managed Service

• yes

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion