Portal del Hermano CVE-2026-53997

Exploitation targets the password-recovery flow specifically - the POST /password/create-access and POST /password/email endpoints. The required preconditions are: (1) the target endpoints must lack rate limiting (stated as the vulnerable condition), (2) the application must return distinct error messages per identity factor, which act as oracles for DNI, date of birth, phone number, and last-four IBAN digits, and (3) the attacker must know or guess the victim's identity (DNI confirmable via oracle, phone obtainable via OSINT). Limiting factors: the attack is per-victim and knowledge-intensive (AC:H), requiring successful brute-force of date-of-birth and IBAN digits plus out-of-band OSINT for the phone number - it is not a single unauthenticated request. No authentication is required (PR:N) and no user interaction is needed (UI:N). Affected deployments are instances of Netherman Portal del Hermano running a build dated before 2026-10-06.

This is a genuine high-severity account-takeover flaw (CWE-640, broken authentication), but several signals temper its real-world urgency. The CVSS 4.0 vector (AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H) confirms a network-reachable, unauthenticated attack (PR:N) with no user interaction, which is why the score reaches 9.1. Critically, Attack Complexity is HIGH (AC:H) - the attack is not a single trivial request but a multi-step chain requiring an oracle-confirmed DNI, brute-forcing of date-of-birth and last-four IBAN digits (rate limiting is absent, which enables this), and out-of-band OSINT to recover the victim's phone number. No EPSS score was provided, the CVE is NOT on CISA KEV, and no public exploit code was referenced, so exploitation status is 'no public exploit identified at time of analysis.' There is no SSVC decision data supplied. The combination of high CVSS but AC:H, no KEV, no POC, and a niche target suggests this is a real but targeted/opportunistic risk rather than a mass-exploitation priority - it is most dangerous to a motivated attacker targeting a specific member, not a worm-able internet-wide threat. EPSS data is MISSING and should be checked before final prioritization.

An unauthenticated attacker targets a known member of a Spanish brotherhood using the portal. Using distinct error messages at POST /password/create-access and POST /password/email as oracles, they confirm the victim's DNI, brute-force the date of birth and last-four IBAN digits against an endpoint lacking rate limiting, recover the phone number via public OSINT, then submit an attacker-controlled email so the password-reset link is delivered to them - yielding full account takeover including the complete IBAN and fiscal documents. No public exploit code is referenced, so an attacker would script the chain themselves; the HIGH attack complexity (AC:H) means it requires effort and some victim-specific knowledge.