Key points
- CVE-2026-53997 is rated CVSS 9.1 Critical by the National Vulnerability Database.
- The flaw exists in password-recovery endpoints before the 2026-10-06 version.
- Attackers can exploit distinct error messages to verify identity factors without credentials.
Netherman Portal del Hermano contains a severe authentication bypass vulnerability that allows unauthenticated attackers to take over member accounts. The National Vulnerability Database assigned CVE-2026-53997 a CVSS score of 9.1, classifying it as critical. The issue affects all software versions released before October 6, 2026.
By the numbers
- 9.1: The CVSS severity score assigned to CVE-2026-53997 by the NVD.
- 4: The number of distinct identity-verification factors attackers can probe via error oracles.
- 2: The specific POST endpoints involved in the broken authentication flow.
What the figures mean
The vulnerability resides in the password-recovery mechanisms at the POST /password/create-access and POST /password/email endpoints. According to the NVD record, the application lacks rate limiting and returns distinct error messages for each verification step. These messages act as oracles, allowing attackers to confirm valid data for four identity factors: DNI, date of birth, phone number, and the last four IBAN digits.
Attackers can use these oracles to verify a DNI, then brute-force the date of birth and IBAN digits. They may obtain the phone number through open-source intelligence. Once these factors are confirmed, the attacker submits a controlled email address. The system then sends the password reset link to the attacker, granting full account takeover. This access includes profile data, full IBAN details, and fiscal documents.
The flaw impacts all tenants using the affected software versions. Because the attack is unauthenticated, anyone with network access to the portal can attempt it. The combination of missing rate limits and verbose error responses makes the brute-force phase feasible. That suggests organizations running versions prior to 2026-10-06 are at immediate risk of mass account compromise.
What should you do?
Managed service providers should immediately inventory all instances of Netherman Portal del Hermano. Check version numbers to identify any installations running software released before October 6, 2026. If no patch is confirmed yet, isolate affected systems from public networks. Monitor logs for unusual activity on password-recovery endpoints.
Background: Rate limiting
Define baseline traffic patterns, then apply graduated limits starting with non-critical endpoints. Use header-based tracking for stateless environments and IP-based counters for stateful ones. Monitor error rates closely, adjust thresholds based on observed variance, and integrate alerts for sudden spikes to prevent service disruption.
Read the full guide: Implement Rate Limiting: A Practical Rollout Plan for Web Services
What to do and how to stay safe: Netherman Portal del Hermano
- Audit all installations of Netherman Portal del Hermano to verify they are updated to versions released on or after 2026-10-06.
- Implement network-level rate limiting on the POST /password/create-access and POST /password/email endpoints to slow down brute-force attempts.
- Configure the application to return generic error messages for all authentication failures, preventing attackers from using distinct responses as oracles.
- Monitor server logs for high volumes of requests to password-recovery endpoints, which may indicate an ongoing enumeration or takeover attempt.
General security guidance from the BitShield News newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is CVE-2026-53997?
It is a critical broken authentication vulnerability in Netherman Portal del Hermano that allows unauthenticated account takeovers via password-recovery endpoints.
Which versions are affected?
All versions of Netherman Portal del Hermano released before October 6, 2026, are affected by this vulnerability.
How do attackers exploit this flaw?
Attackers use distinct error messages to verify identity factors like DNI and IBAN, then submit their own email to receive password reset links.
