CVE-2026-53997
HighCVSS 7.4Exploitation Probability (EPSS)
Low risk32th percentile - higher than 32% of all known CVEs
Summary
Netherman Portal del Hermano (portaldelhermano.es) before 2026-10-06 contains a broken authentication vulnerability in its password-recovery flow at the POST /password/create-access and POST /password/email endpoints. The lack of rate limiting and distinct error messages acting as oracles for each of the four identity-verification factors (DNI, date of birth, phone number, last four IBAN digits) allow unauthenticated attackers to take over any member account across all tenants.
Risk Assessment
An attacker can confirm the DNI, brute-force the date of birth and IBAN digits, obtain the phone number via OSINT, then submit an attacker-controlled email so the reset link is delivered to them, enabling full account takeover including profile data, full IBAN, and fiscal documents.
Recommendation
Implement rate limiting, unify error messages so they do not act as oracles, and verify email ownership before sending the password reset link.
Related vulnerabilities
- CVE-2026-113744Critical
A security vulnerability has been detected in Tenda AC19 16.03.10.07. The impacted element is the function formSetFirewallCfg of the file /goform/SetFirewallCfg of the httpd Web Management Service component. Manipulation of the firewallEn argument leads to a stack-based buffer overflow. The attack may be launched remotely and the exploit has been publicly disclosed.
- CVE-2026-114119Critical
Best Practice Software Bp Premier before 1.14.1.1128 uses a hardcoded Microsoft SQL Server administrative password that is shared across all installations and cannot be changed without breaking the application. Attackers with network access to the database instance can authenticate as sysadmin, bypass application authentication, and execute operating system commands as SYSTEM.
- CVE-2026-114108Critical
HKUDS Vibe-Trading from 0.1.0 before 0.1.7 contains a missing authentication vulnerability that allows unauthenticated attackers to access the FastAPI surface because require_auth() returns early when API_AUTH_KEY is unset. Attackers can post messages to /sessions/{id}/messages to trigger root shell commands via BashTool, upload .py or .sh files via /upload, read session histories, and obtain partial API keys.
- CVE-2026-113736Critical
A vulnerability has been found in D-Link DHP-W610AV 1.02EUb03. The impacted element is the function login_prepare_hnap of the file etc/defnodes/defaultvalue.xml of the HNAP Login component. Manipulation of the Password argument leads to an empty password in the configuration file. The attack can be initiated remotely and the exploit has been disclosed to the public.
- CVE-2026-92559Critical
IBM App Connect Enterprise 13.0.1.0 through 13.0.8.2 could allow a remote attacker to obtain sensitive information due to binding to an unrestricted IP address.
- CVE-2026-91665Critical
Vulnerability in Oracle Essbase (component: Security) affecting version 21.8.3.0.0. An easily exploitable vulnerability allows an unauthenticated attacker with network access via TCP to compromise Oracle Essbase. CVSS 3.1 Base Score 9.8.
- CVE-2026-91663Critical
Vulnerability in Oracle Essbase (component: Security) affecting version 21.8.3.0.0. An easily exploitable vulnerability allows a low-privileged attacker with network access via T3, IIOP to compromise Oracle Essbase, with potential impact on additional products (scope change). CVSS 3.1 Base Score 9.9.
- CVE-2026-91658Critical
Vulnerability in Oracle Essbase (component: Security) affecting version 21.8.3.0.0. An easily exploitable vulnerability allows a low-privileged attacker with network access via HTTP to compromise Oracle Essbase, with potential impact on additional products (scope change). CVSS 3.1 Base Score 9.9.
- CVE-2026-91656Critical
Vulnerability in Oracle Essbase (component: Federated Partitions) affecting version 21.8.3.0.0. An easily exploitable vulnerability allows a low-privileged attacker with network access via HTTP to gain unauthorized access to critical data, update, insert or delete it, and cause a partial denial of service, with potential impact on additional products (scope change). CVSS 3.1 Base Score 9.1.
- CVE-2026-91655Critical
Vulnerability in Oracle Essbase (Security component) affecting version 21.8.3.0.0. A low-privileged attacker with network access via HTTP can exploit it to gain unauthorized access to critical data, modify data, and cause partial denial of service. CVSS 9.1.
Original NVD description (English source)
Netherman Portal del Hermano (portaldelhermano.es) before 2026-10-06 contains a broken authentication vulnerability in its password-recovery flow at the POST /password/create-access and POST /password/email endpoints, allowing unauthenticated attackers to take over any member account across all tenants by exploiting the lack of rate limiting and distinct error messages that act as oracles for each of the four identity-verification factors (DNI, date of birth, phone number, last four IBAN digits). Attackers can confirm the DNI via the oracle, brute-force the date of birth and IBAN digits, obtain the phone number through open-source intelligence, then submit an attacker-controlled email field so the password reset link is delivered to them, enabling full account takeover including profile data, full IBAN, and fiscal documents.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS