CVE-2026-33710: Chamilo LMS has Weak REST API Key Generation (Predictable)
Chamilo LMS is a learning management system. Prior to 1.11.38 and 2.0.0-RC.3, REST API keys are generated using md5(time() + (userid 5) - rand(10000, 10000)). The rand(10000, 10000) call always returns exactly 10000 (min == max), making the formula effectively md5(timestamp + userid5 - 10000). An attacker who knows a username and approximate key creation time can brute-force the API key. This vulnerability is fixed in 1.11.38 and 2.0.0-RC.3.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the vulnerability CVE-2026-33710?
CVE-2026-33710 pertains to predictable REST API key generation in Chamilo LMS due to using a non-random method for generating keys.
What versions of Chamilo LMS are affected by CVE-2026-33710?
CVE-2026-33710 affects Chamilo LMS versions prior to 1.11.38 and 2.0.0-RC.3.
What is the potential impact of CVE-2026-33710?
The predictable nature of the REST API keys in CVE-2026-33710 can lead to unauthorized access and data breaches.
How do I fix CVE-2026-33710?
To fix CVE-2026-33710, upgrade Chamilo LMS to version 1.11.38 or 2.0.0-RC.3 or later.
Is there a workaround for CVE-2026-33710?
No official workaround is available for CVE-2026-33710; the best approach is to upgrade to the patched versions.