Authentication Bypass in Netherman Portal del Hermano

The Netherman Portal del Hermano platform (portaldelhermano.es) contained a critical broken authentication vulnerability in its password-recovery mechanism prior to October 6, 2026. The vulnerability stems from the implementation of the /password/create-access and /password/email endpoints, which fail to enforce rate limits and provide granular error messages that act as validation oracles. An unauthenticated attacker can query these endpoints to systematically confirm individual identity-verification factors, specifically the DNI, date of birth, phone number, and last four digits of an IBAN. By leveraging these oracles, an attacker can brute-force the required identity components to hijack user accounts. Upon successful validation, the attacker can supply their own email address to receive the password reset token, resulting in full unauthorized access to the victim's profile, including sensitive fiscal documents and full banking details.

Impact

Successful exploitation allows for full account takeover of any member account across the platform. This leads to the exposure of highly sensitive personal data, including complete IBANs, fiscal records, and personal identification information stored within the portal. Given the nature of the information hosted on the site, unauthorized access poses significant risks of identity theft and financial fraud for all affected users.

Recommendation

• Upgrade the Portal del Hermano application to the version released on or after 2026-10-06.
• Audit logs for the /password/create-access and /password/email endpoints to identify anomalous spikes in requests from single source IPs, which may indicate enumeration attempts targeting the identification oracle.
• Implement strict rate limiting on all authentication and password recovery endpoints to prevent automated enumeration and brute-force attacks.
• Standardize error responses for authentication flows to ensure that distinct messages cannot be used to distinguish between valid and invalid input fields.