CVE-2026-53997 Netherman Portal del Hermano Account Takeover via Password Reset Oracle
Unauthenticated attackers can take over any member account by exploiting password reset oracles and lack of rate limiting to bypass identity verification.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-53997?
CVE-2026-53997 is a critical authentication bypass vulnerability in NetHerman Portal del Hermano (portaldelhermano.es), published on 12 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Netherman Portal del Hermano (portaldelhermano.es) before 2026-10-06 contains a broken authentication vulnerability in its password-recovery flow at the POST /password/create-access and POST /password/email endpoints, allowing unauthenticated attackers to take over any member account across all tenants by exploiting the lack of rate limiting and distinct error messages that act as oracles for each of the four identity-verification factors (DNI, date of birth, phone number, last four IBAN digits). Attackers can confirm the DNI via the oracle, brute-force the date of birth and IBAN digits, obtain the phone number through open-source intelligence, then submit an attacker-controlled email field so the password reset link is delivered to them, enabling full account takeover including profile data, full IBAN, and fiscal documents.
Which versions are affected by CVE-2026-53997?
How do I fix CVE-2026-53997?
No fix has been published for CVE-2026-53997 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-53997 being exploited?
There is no known exploitation of CVE-2026-53997 in the wild and no public exploit code.
Sources
Also known as GHSA-p44j-p338-ffrc.