CVE-2026-33710

Chamilo LMS is a learning management system. Prior to 1.11.38 and 2.0.0-RC.3, REST API keys are generated using md5(time() + (user_id * 5) - rand(10000, 10000)). The rand(10000, 10000) call always returns exactly 10000 (min == max), making the formula effectively md5(timestamp + user_id*5 - 10000). An attacker who knows a username and approximate key creation time can brute-force the API key. This vulnerability is fixed in 1.11.38 and 2.0.0-RC.3.

• CWE-330

• https://github.com/chamilo/chamilo-lms/commit/4448701bb8ec557e94ef02d19c72cbe9c49c2d09Patch
• https://github.com/chamilo/chamilo-lms/commit/e7400dd840586ae134b286d0a2374f3d269a9a9dPatch
• https://github.com/chamilo/chamilo-lms/security/advisories/GHSA-rpmg-j327-mr39Vendor Advisory

Published

Apr 10, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-33705Chamilo LMS is a learning management system. Prior to 1.11.3…5.3
• CVE-2026-33706Chamilo LMS is a learning management system. Prior to 1.11.3…7.1
• CVE-2026-33707Chamilo LMS is a learning management system. Prior to 1.11.3…9.8
• CVE-2026-33708Chamilo LMS is a learning management system. Prior to 1.11.3…6.5
• CVE-2026-33709JupyterHub is software that allows one to create a multi-use…6.1
• CVE-2026-3371The Tutor LMS – eLearning and online course solution plugin …4.3
• CVE-2026-33711Incus is a system container and virtual machine manager. Inc…7.8
• CVE-2026-33712Typebot is a chatbot builder tool. In versions 3.15.2 and pr…10
• CVE-2026-33713n8n is an open source workflow automation platform. Prior to…8.8
• CVE-2026-33714Chamilo is an open-source learning management system (LMS). …7.2
• CVE-2026-33715Chamilo LMS is an open-source learning management system. In…7.2
• CVE-2026-33716WWBN AVideo is an open source video platform. In versions up…9.4