CVE-2026-53997: Weak Password Recovery Mechanism for Forgotten Password in NetHerman Portal del Hermano (portaldelhermano.es)

CVE-2026-53997 describes a broken authentication vulnerability in the password recovery flow of NetHerman Portal del Hermano (portaldelhermano.es) versions before 2026-10-06. The vulnerability arises from the absence of rate limiting and the presence of distinct error messages that serve as oracles for four identity-verification factors: DNI, date of birth, phone number, and last four IBAN digits. An attacker can confirm the DNI, brute-force the date of birth and IBAN digits, and obtain the phone number via open-source intelligence. By submitting an attacker-controlled email address, the attacker receives the password reset link, enabling full account takeover including access to profile data, full IBAN, and fiscal documents.

Successful exploitation allows unauthenticated attackers to take over any member account across all tenants of the portal. This leads to full compromise of user accounts, including access to sensitive personal information and financial documents, posing severe privacy and financial risks to users.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, organizations should consider implementing additional rate limiting on password recovery endpoints and avoid revealing distinct error messages that confirm identity factors. Monitoring for suspicious password recovery attempts may help detect exploitation attempts.