Key points
- The vulnerability is rated Critical with a CVSS score of 9.1 by the NVD.
- Attackers can bypass security by brute-forcing identity factors using distinct error codes.
- The flaw affects versions of the portal released before October 6, 2026.
A severe security flaw in Netherman Portal del Hermano has been identified, allowing attackers to take over user accounts without any prior login. The issue resides in the password recovery system, specifically within the endpoints used to create access and verify email addresses. According to the National Vulnerability Database, this broken authentication vulnerability is rated Critical with a CVSS score of 9.1. It affects all instances of the software running versions prior to the October 6, 2026 update.
In plain English
The portal’s password reset process fails to protect user data adequately. When a user attempts to recover their password, the system responds with specific error messages for incorrect information. These messages act as oracles, confirming whether details like the DNI or date of birth are correct. Attackers can use these responses to systematically guess and verify four identity factors: the DNI, date of birth, phone number, and the last four digits of the IBAN.
Because there are no rate limits to slow down repeated attempts, an attacker can brute-force these details. Once the identity factors are confirmed, the attacker submits their own email address. The system then sends the password reset link to the attacker, granting them full control of the victim’s account. This access includes sensitive profile data, full bank details, and fiscal documents.
The background
The vulnerability is classified under CWE-640 and CWE-307, relating to authentication issues and incorrect handling of sensitive data. The flaw allows unauthenticated threats to compromise any member account across all tenants hosted on the platform. The distinct error messages provide the necessary feedback for attackers to validate their guesses against the four verification factors.
What changes now
Users and administrators relying on Netherman Portal del Hermano must ensure their systems are updated to versions released after October 6, 2026. The source material indicates that versions before this date contain the vulnerability. No further remediation steps or patches beyond this version threshold are mentioned in the current records.
What to do and how to stay safe: Netherman Portal del Hermano
- Verify that your instance of Netherman Portal del Hermano is updated to the version released on or after 6 October 2026.
- Monitor account activity for unexpected password reset requests or login attempts from unfamiliar locations.
- Ensure that multi-factor authentication is enabled on all user accounts to add an extra layer of security.
- Review server logs for repeated failed attempts on password recovery endpoints, which may indicate brute-force activity.
Step-by-step guide: Emergency Patching: Correcting Five Common Operational Errors
General security guidance from the RedTeam Log newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the severity of CVE-2026-53997?
The NVD rates it as Critical with a CVSS score of 9.1.
Which software versions are affected?
All versions of Netherman Portal del Hermano released before October 6, 2026.
How do attackers exploit this flaw?
They use distinct error messages to verify identity factors and brute-force them due to missing rate limits.
