CVE-2026-53997: Portal del Hermano (portaldelhermano.es) 0 to before 2026-10-06

Affected technology

Portal del Hermano (portaldelhermano.es) · 0 to before 2026-10-06
NetHerman

Description’s affected range: before 2026-10-06

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 4.0): Network (remote) · No privileges required · No user interaction required

What an attacker can do

Unauthenticated attackers can take over any member account across all tenants by exploiting the lack of rate limiting and distinct error messages that act as oracles for each of the four identity-verification factors (DNI, date of birth, phone number, last four IBAN digits). Vendor/CNA’s CVSS 4.0 assessment (base score 9.1/10) rates confidentiality and integrity impact as high; availability impact as none.