Unauthenticated Attackers Can Hijack Netherman Portal Accounts via Broken Auth Flow

Organisations using Netherman Portal del Hermano face immediate risk from a critical authentication flaw that allows unauthenticated attackers to take over member accounts. The National Vulnerability Database records this issue as CVE-2026-53997, assigning it a severity score of 9.1. This rating reflects the ease with which remote attackers can bypass security controls and access sensitive fiscal data without possessing valid credentials for the target system.

How it unfolded

• The vulnerability exists in the password-recovery mechanisms at specific POST endpoints for access creation and email verification.
• Lack of rate limiting enables attackers to repeatedly submit requests to test identity verification factors.
• Distinct error messages serve as oracles, confirming valid DNI numbers, dates of birth, phone details, and IBAN digits.

Who is affected

Any deployment of NetHerman Portal del Hermano operating on versions released before 2026-10-06 is vulnerable to this attack vector. According to the NVD record, the flaw impacts all tenants hosted on the platform. Attackers can leverage open-source intelligence to obtain phone numbers, then combine this with brute-forced IBAN digits and verified DNI numbers to complete the authentication bypass. This enables them to submit an attacker-controlled email address, redirecting password reset links away from legitimate users and facilitating full account takeover.

The fix

The vendor has identified the issue in releases prior to 2026-10-06. Users running older versions of the software remain exposed to unauthenticated account takeover attacks. There is no indication in the source material that a patch or update has been universally deployed or confirmed as available for all affected environments. Administrators should verify their current version status against the 2026-10-06 threshold to determine exposure. Until a confirmed fix is applied, the risk of credential compromise remains high for all users associated with the platform.

Background: Account takeover

Account takeover occurs when an attacker gains control of your online identity. This happens through stolen credentials, weak recovery methods, or social engineering. Protect yourself by using unique passwords, enabling authenticator apps, and verifying who requests sensitive data.

Read the full guide: Account Takeover: How Hackers Steal Your Digital Identity

What to do and how to stay safe: Netherman Portal del Hermano

• Review your current version of Netherman Portal del Hermano to determine if it predates the 2026-10-06 release.
• Monitor server logs for unusual POST requests to password recovery endpoints, particularly from unknown IP addresses.
• Implement additional monitoring for rapid succession of failed authentication attempts on identity verification fields.
• Consider restricting access to password reset interfaces via IP whitelisting or additional multi-factor authentication layers where possible.

Step-by-step guide: Patch Management: Eight Questions Answered for Stability

General security guidance from the Malware Brief newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Does CVE-2026-53997 require an attacker to have a password?

No, the vulnerability allows unauthenticated attackers to bypass login requirements entirely by exploiting the password recovery flow.

What specific data can attackers access after a successful takeover?

Attackers gain access to profile data, full IBAN numbers, and fiscal documents stored within the member accounts.

Is this vulnerability actively being exploited in the wild?

The source material does not state whether the flaw is currently being exploited in active attacks, only that it allows for account takeover.