{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/vendors/netherman/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:netherman:portal_del_hermano:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.4,"id":"CVE-2026-53997"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Portal del Hermano (\u003c 2026-10-06)"],"_cs_severities":["high"],"_cs_tags":["cve-2026-53997","authentication-bypass","web-security"],"_cs_type":"advisory","_cs_vendors":["Netherman"],"content_html":"\u003cp\u003eThe Netherman Portal del Hermano platform (portaldelhermano.es) contained a critical broken authentication vulnerability in its password-recovery mechanism prior to October 6, 2026. The vulnerability stems from the implementation of the /password/create-access and /password/email endpoints, which fail to enforce rate limits and provide granular error messages that act as validation oracles. An unauthenticated attacker can query these endpoints to systematically confirm individual identity-verification factors, specifically the DNI, date of birth, phone number, and last four digits of an IBAN. By leveraging these oracles, an attacker can brute-force the required identity components to hijack user accounts. Upon successful validation, the attacker can supply their own email address to receive the password reset token, resulting in full unauthorized access to the victim's profile, including sensitive fiscal documents and full banking details.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows for full account takeover of any member account across the platform. This leads to the exposure of highly sensitive personal data, including complete IBANs, fiscal records, and personal identification information stored within the portal. Given the nature of the information hosted on the site, unauthorized access poses significant risks of identity theft and financial fraud for all affected users.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade the Portal del Hermano application to the version released on or after 2026-10-06.\u003c/li\u003e\n\u003cli\u003eAudit logs for the /password/create-access and /password/email endpoints to identify anomalous spikes in requests from single source IPs, which may indicate enumeration attempts targeting the identification oracle.\u003c/li\u003e\n\u003cli\u003eImplement strict rate limiting on all authentication and password recovery endpoints to prevent automated enumeration and brute-force attacks.\u003c/li\u003e\n\u003cli\u003eStandardize error responses for authentication flows to ensure that distinct messages cannot be used to distinguish between valid and invalid input fields.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-12T22:44:36Z","date_published":"2026-10-12T22:44:36Z","id":"https://feed.craftedsignal.io/briefs/2026-10-netherman-auth-bypass/","summary":"An authentication flaw in the Netherman Portal del Hermano password-recovery flow allows attackers to perform account takeovers by exploiting rate-limit gaps and error-message oracles.","title":"Authentication Bypass in Netherman Portal del Hermano","url":"https://feed.craftedsignal.io/briefs/2026-10-netherman-auth-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - Netherman","version":"https://jsonfeed.org/version/1.1"}