Portal Del Hermano Portaldelhermano Es
Monthly
Unauthenticated account takeover in Portal del Hermano (Netherman, portaldelhermano.es) builds earlier than 2026-10-06 exploits the password-recovery endpoints POST /password/create-access and POST /password/email, which lack rate limiting and return distinct error messages acting as oracles for DNI, date of birth, phone number, and last four IBAN digits. An attacker can confirm the DNI, brute-force date of birth and IBAN digits, obtain the phone number via OSINT, and supply an attacker-controlled email to receive the password-reset link, achieving full takeover of any member account across all tenants, including profile data, full IBAN, and fiscal documents. No public exploit identified at time of analysis; disclosed CVSS 9.1 (CVSS 4.0) reflects high impact but high attack complexity (AC:H, PR:N, UI:N per independent assessment).
Unauthenticated account takeover in Portal del Hermano (Netherman, portaldelhermano.es) builds earlier than 2026-10-06 exploits the password-recovery endpoints POST /password/create-access and POST /password/email, which lack rate limiting and return distinct error messages acting as oracles for DNI, date of birth, phone number, and last four IBAN digits. An attacker can confirm the DNI, brute-force date of birth and IBAN digits, obtain the phone number via OSINT, and supply an attacker-controlled email to receive the password-reset link, achieving full takeover of any member account across all tenants, including profile data, full IBAN, and fiscal documents. No public exploit identified at time of analysis; disclosed CVSS 9.1 (CVSS 4.0) reflects high impact but high attack complexity (AC:H, PR:N, UI:N per independent assessment).