Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Chamilo LMS is a learning management system. Prior to 1.11.38 and 2.0.0-RC.3, REST API keys are generated using md5(time() + (user_id * 5) - rand(10000, 10000)). The rand(10000, 10000) call always returns exactly 10000 (min == max), making the formula effectively md5(timestamp + user_id*5 - 10000). An attacker who knows a username and approximate key creation time can brute-force the API key. This vulnerability is fixed in 1.11.38 and 2.0.0-RC.3.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
1 version affected across 1 product
CVE-2026-33710 Chamilo LMS is a learning management system. Prior to 1.11.38 and 2.0.0-RC.3, REST API keys are generated using md5(time() + (user_id * 5) - rand(10000, 10000)). The … https://www.cve.org/CVERecord?id=CVE-2026-33710
Post summary
The post announces a vulnerability in Chamilo LMS’s REST API key generation, providing technical details but no evidence of exploitation, PoC, or mitigation.
CVE-2026-33710 Weak REST API Key Generation in Chamilo LMS Prior to 1.11.38 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-33710 Vulnerability Alert Subscriptions: https://alerts.vulmon.com/?utm_source=twitter&utm_medium=social&utm_campaign=2102281&utm_content=1
Post summary
Short alert announcing a weak REST API key generation flaw in Chamilo LMS before version 1.11.38. No exploit, patch, or active exploitation details are given.
11 of 11 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | chamilo | chamilo_lms | - | - | - |
| App | chamilo | chamilo_lms | 2.0.0 | - | - |
| App | chamilo | chamilo_lms | 2.0.0 | - | - |
| App | chamilo | chamilo_lms | 2.0.0 | - | - |
| App | chamilo | chamilo_lms | 2.0.0 | - | - |
| App | chamilo | chamilo_lms | 2.0.0 | - | - |
| App | chamilo | chamilo_lms | 2.0.0 | - | - |
| App | chamilo | chamilo_lms | 2.0.0 | - | - |
| App | chamilo | chamilo_lms | 2.0.0 | - | - |
| App | chamilo | chamilo_lms | 2.0.0 | - | - |
| App | chamilo | chamilo_lms | 2.0.0 | - | - |