CVE-2026-33710
Published: 10 April 2026
Summary
CVE-2026-33710 is a high-severity Use of Insufficiently Random Values (CWE-330) vulnerability in Chamilo Chamilo Lms. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 13.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 IA-5 (Authenticator Management) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2026-33710 is a vulnerability in Chamilo LMS, an open-source learning management system, affecting versions prior to 1.11.38 and 2.0.0-RC.3. The issue stems from flawed REST API key generation, where keys are produced using the MD5 hash of time() + (user_id * 5) - rand(10000, 10000). The rand() function with identical min and max parameters always returns exactly 10000, reducing the formula to a predictable md5(timestamp + user_id*5 - 10000). This weakness aligns with CWE-330: Use of Insufficiently Random Values and carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).
An unauthenticated attacker with network access can exploit this vulnerability if they know a target username and the approximate key creation timestamp. By brute-forcing a narrow range of timestamps combined with the known user_id, they can compute the exact API key, enabling unauthorized access to REST API endpoints and potentially exposing sensitive learning management data.
The vulnerability is addressed in Chamilo LMS versions 1.11.38 and 2.0.0-RC.3. Patches are detailed in GitHub commits 4448701bb8ec557e94ef02d19c72cbe9c49c2d09 and e7400dd840586ae134b286d0a2374f3d269a9a9d, with further guidance in the security advisory at GHSA-rpmg-j327-mr39. Administrators should upgrade to a fixed version to mitigate the risk.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-21565
Vulnerability details
Chamilo LMS is a learning management system. Prior to 1.11.38 and 2.0.0-RC.3, REST API keys are generated using md5(time() + (user_id * 5) - rand(10000, 10000)). The rand(10000, 10000) call always returns exactly 10000 (min == max), making the formula…
more
effectively md5(timestamp + user_id*5 - 10000). An attacker who knows a username and approximate key creation time can brute-force the API key. This vulnerability is fixed in 1.11.38 and 2.0.0-RC.3.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability allows unauthenticated network attackers to predict and obtain valid REST API keys in a public-facing application due to insufficient randomness in key generation, directly enabling exploitation of the public-facing LMS.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
IA-5 mandates management of authenticators including generation with sufficient strength and randomness, directly countering the predictable MD5-based REST API key generation using insufficiently random values.
SI-2 requires timely flaw remediation, such as applying patches for CVE-2026-33710 that fix the flawed API key generation algorithm in Chamilo LMS.
RA-5 supports vulnerability scanning to identify and prioritize known weaknesses like CVE-2026-33710's insufficient randomness in API keys.