Netherman Portal del Hermano: Account takeover via password reset oracle
Summary
Netherman Portal del Hermano, the members' portal of the NetHerman platform for Spanish brotherhoods, has a broken authentication flaw in its password recovery. Unauthenticated attackers can exploit missing rate limiting and distinct error messages to verify identity factors such as DNI, date of birth, phone number and IBAN digits. They can then supply their own email address so the reset link is delivered to them, which enables full takeover of member accounts across all tenants, including profile data, full IBAN and fiscal documents.
Affected
- Netherman Portal del Hermano (portaldelhermano.es), all tenants
- Versions before 2026-10-06 according to the CVE record and VulnCheck
- Exact affected version numbers: Unknown.
Fixed in
- Vendor confirmation: Unknown.
- Third-party sources name 2026-10-06 as the fixed version; this is unconfirmed.
Workaround
- Unknown. No workaround is documented in the CVE record or the sources.
- As a hosted portal, the fix must be deployed by the vendor.
Exploitation
- Not listed in CISA KEV; no known exploitation reported.
- VulDB: known technical details, no public exploit available, exploitation considered easy.
- CISA SSVC: Exploitation none, Automatable no, Technical Impact total.
Our recommendation
- Check whether any client or client member uses this portal.
- Ask the vendor in writing to confirm the fixed version and the date it was deployed.
- Ask the vendor to check logs for password-reset abuse and unusual account changes.
- Advise affected members to change their passwords and check their bank statements.
- If Swiss personal data is affected, assess notification duties under the revised Swiss Federal Act on Data Protection (revFADP).
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CVE-2026-53997 advisory (beafn28.es) beafn28.es
- VulnCheck advisory www.vulncheck.com
- NetHerman vendor website netherman.app
- VulDB entry 417224 vuldb.com
- OpenCVE CVE-2026-53997 app.opencve.io
- HOL Guard CVE-2026-53997 hol.org
- Strix CVE-2026-53997 www.strix.ai
- Rapid7 entry via Vulners vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 06:53.
Original description (NVD)
Netherman Portal del Hermano (portaldelhermano.es) before 2026-10-06 contains a broken authentication vulnerability in its password-recovery flow at the POST /password/create-access and POST /password/email endpoints, allowing unauthenticated attackers to take over any member account across all tenants by exploiting the lack of rate limiting and distinct error messages that act as oracles for each of the four identity-verification factors (DNI, date of birth, phone number, last four IBAN digits). Attackers can confirm the DNI via the oracle, brute-force the date of birth and IBAN digits, obtain the phone number through open-source intelligence, then submit an attacker-controlled email field so the password reset link is delivered to them, enabling full account takeover including profile data, full IBAN, and fiscal documents.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.