CVE-2026-33710

OVERVIEW Chamilo LMS versions prior to 1.11.38 and 2.0.0-RC.3 contain a cryptographic weakness in REST API key generation. The vulnerability stems from improper use of the rand() function with identical minimum and maximum parameters (rand(10000, 10000)), which always returns 10000, thereby reducing the entropy of the generated keys to a predictable formula based solely on timestamp and user ID. SEVERITY This vulnerability carries a CVSS 3.1 score of 7.5 (HIGH) with a network attack vector, low attack complexity, and no authentication requirements. The flaw enables attackers with knowledge of a username and approximate key creation time to conduct brute-force attacks to recover valid API keys, resulting in high confidentiality impact through unauthorized API access. The attack requires no user interaction and can be executed remotely. EXPLOITATION STATUS The vulnerability is not currently tracked as actively exploited in the Known Exploited Vulnerabilities (KEV) catalog and remains inactive on security hot lists. However, the straightforward nature of the vulnerability and the availability of the technical details make exploitation relatively feasible for threat actors. The low EPSS score suggests minimal current exploitation activity, though organizations running affected versions should prioritize patching to Chamilo 1.11.38 or 2.0.0-RC.3 or later.