Chamilo Learning Management System generates REST API keys with a deterministic formula that combines the current timestamp with the user identifier and a constant random value. Because the random call always returns the same number and md5 hashing is applied, the resulting key can be predicted if an attacker knows the user and approximate creation time. This flaw allows an adversary to brute‑force a valid key and gain unauthorized API access, compromising data confidentiality and integrity. The weakness is a predictable random function misuse (CWE‑330).

All Chamilo LMS releases older than 1.11.38 and 2.0.0‑RC.3 are affected. The vulnerability exists in the core code that performs key generation and is present in all deployments of the system that rely on the legacy API key routine.

The vulnerability carries a CVSS score of 7.5, indicating a high severity classification. EPSS data is not available, and the flaw is not listed in the CISA Known Exploit Vulnerabilities catalog. An attacker could exploit the weakness remotely by accessing the API endpoint, submitting a known username and a time window estimate, then iteratively generating candidate keys until the correct one is found. The attack requires knowledge of the username and approximate key creation time, but no additional privileges are needed beyond API access rights. The predictability of key generation directly lowers the effort needed for a brute‑force attempt, elevating the risk of compromise.