In NetHerman's Portal del Hermano, the password‑recovery flow at the POST /password/email and POST /password/create-access endpoints contains a flaw that allows attackers without authentication to take over any member account. The vulnerability stems from missing rate limiting (CWE-307) and distinct error messages that reveal whether a verification factor (DNI, date of birth, phone number, or last four IBAN digits) is correct (CWE-640). Attackers can confirm the DNI through the oracle, brute‑force the date of birth and IBAN digits, obtain the phone number via OSINT, and then submit a controlled email address so the password reset link is delivered to them, enabling full account takeover including personal data, bank details, and fiscal documents.

The affected system is NetHerman's Portal del Hermano platform (portal del hermano.es) for all tenants, in any version released prior to 2026‑10‑06. No specific patch version is listed in the data.

The vulnerability has a CVSS score of 9.1, indicating critical severity. The EPSS score is not available, and it is not listed in the CISA KEV catalogue, so there is no known public exploit yet. Attackers could exploit the flaw remotely via the web interface, using automated scripts to send repeated requests to the endpoints, leveraging the oracle to discover valid identity information and retrieve password reset links. Because of the lack of rate limiting, the attack surface is large and the probability of successful compromise is high.