Chamilo LMS's REST API key generation prior to versions 1.11.38 and 2.0.0-RC.3 uses md5(time() + (user_id * 5) - rand(10000, 10000)), where rand(10000, 10000) always returns 10000 due to identical min and max parameters. This results in predictable API keys based on timestamp and user ID, enabling brute-force attacks by adversaries with knowledge of the username and approximate key creation time. The vulnerability is classified under CWE-330 (Use of Insufficiently Random Values). It is fixed in Chamilo LMS versions 1.11.38 and 2.0.0-RC.3.

An attacker can brute-force REST API keys if they know a username and approximate key creation time, potentially gaining unauthorized access to the API. The vulnerability impacts confidentiality but does not affect integrity or availability. The CVSS 3.1 score of 7.5 reflects a high severity with network attack vector, low attack complexity, no privileges required, and no user interaction needed.

Upgrade Chamilo LMS to version 1.11.38 or later, or to 2.0.0-RC.3 or later, where the API key generation method has been fixed to use sufficient randomness. No other mitigation or temporary fix is indicated. Patch status is not explicitly stated but the vulnerability is fixed in the specified versions.