CVSS 9.1: Netherman Portal's Missing Rate Limits Enable Password Reset Brute-Force Attacks
A critical authentication flaw in Netherman Portal allows unauthenticated attackers to hijack accounts by exploiting missing rate limits and verbose error messages.
Key points
- The vulnerability is rated CVSS 9.1 Critical by the National Vulnerability Database.
- Attackers can reset passwords for any tenant by brute-forcing four identity factors.
- No patch has been confirmed for versions prior to the October 2026 update window.
The National Vulnerability Database lists CVE-2026-53997 as a critical security flaw in Netherman Portal del Hermano. This vulnerability affects software versions released before October 6, 2026. The issue stems from broken authentication logic within the password recovery process. Unauthenticated attackers can exploit this weakness to take over member accounts across all tenants. The flaw allows full access to sensitive user data without prior login credentials.
How does the password recovery attack work?
The attack targets two specific endpoints: POST /password/create-access and POST /password/email. The system fails to implement rate limiting on these requests. Additionally, the application returns distinct error messages that reveal whether specific identity inputs are correct. These messages act as oracles for four verification factors: DNI, date of birth, phone number, and the last four digits of an IBAN. Attackers use these responses to confirm data validity during the brute-force process.
What data can attackers steal?
Once the attacker confirms the DNI through the oracle, they proceed to brute-force the date of birth and the final four IBAN digits. The phone number is often obtained through open-source intelligence techniques before the technical attack begins. After validating these factors, the attacker submits a controlled email address. The system then sends the password reset link to this attacker-controlled inbox. This grants full account takeover, including access to profile data, full IBAN details, and fiscal documents.
Why is the CVSS score so high?
The National Vulnerability Database assigns a CVSS score of 9.1 to this vulnerability. This rating reflects the ease of exploitation and the severity of the impact. The flaw is classified under CWE-640 and CWE-307. Because the attack requires no authentication, the attack complexity is low. The impact is total account compromise across all tenants. The lack of rate limiting allows attackers to make unlimited attempts. This combination of low effort and high damage results in a critical severity rating.
What is the current fix status?
The National Vulnerability Database record indicates that versions prior to October 6, 2026 are affected. The source material does not confirm the availability of a patch or update for current installations. Organizations using Netherman Portal del Hermano should verify their version status immediately. If the software version is earlier than the October 2026 cutoff, it is vulnerable. No workaround or temporary mitigation is described in the provided technical report. Users should monitor vendor communications for official remediation guidance.
Background: National Vulnerability Database
The National Vulnerability Database is the U.S. government’s repository of security flaws in software and hardware. It assigns unique identifiers to each issue, allowing organizations to track, prioritize, and remediate risks using standardized references rather than vague descriptions.
Read the full guide: National Vulnerability Database: Meaning, Structure, and Daily Use
What to do and how to stay safe
- Verify if your organization uses Netherman Portal del Herman
Step-by-step guide: Patch Management Checklist: Secure Systems Without Breaking Them
General security guidance from the Firewall Scoop newsroom. It is not confirmed advice from the organisations named in this story.
