CVE-2026-33710 affects Chamilo LMS where REST API keys are generated using md5(time() + (user_id * 5) - rand(10000, 10000)). Because rand(10000, 10000) always returns 10000, the key generation formula effectively becomes md5(timestamp + user_id*5 - 10000), resulting in insufficient randomness (CWE-330). This predictable key generation enables brute-force attacks if the attacker knows the username and approximate key creation time. The vulnerability impacts versions prior to 1.11.38 and between 2.0.0-alpha.1 and before 2.0.0-RC.3. It has a CVSS 3.1 base score of 7.5 (high severity) with network attack vector, low attack complexity, no privileges required, no user interaction, and high confidentiality impact but no integrity or availability impact. The vulnerability is fixed in Chamilo LMS versions 1.11.38 and 2.0.0-RC.3.

An attacker can brute-force REST API keys due to insufficient randomness in key generation, potentially gaining unauthorized read access to sensitive information via the API. The confidentiality of data is at high risk, but integrity and availability are not impacted. No known exploits are reported in the wild at this time.

Upgrade Chamilo LMS to version 1.11.38 or later, or to 2.0.0-RC.3 or later, where this vulnerability is fixed. Patch status is confirmed by the version information in the advisory. No other mitigation is indicated.