External risk intelligence

Chamilo LMS Password Reset Token Predictability Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-33707

Chamilo LMS is a web-based learning management system designed to be accessed by students and instructors. Such platforms are commonly deployed as public-facing web applications to facilitate remote access for users, making the password reset mechanism a component of an internet-reachable service.

Chamilo Lms

before 1.11.382.0.0

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in Chamilo LMS, a learning management system. The issue lies within the password reset mechanism, which can allow an attacker to gain unauthorized access to user accounts by predicting password reset tokens without needing a user's email or any interaction from the user. This could impact the confidentiality and integrity of user data.

Weak password reset allows account takeover.
Protects user data and system integrity.
Confirm relevance and assess exposure.

Attack Path

How an attacker could exploit the issue

An attacker can exploit this vulnerability by first obtaining a user's email address. Then, they can predict the password reset token by hashing the email with SHA1, allowing them to reset any user's password without any prior authentication or rate limiting. This can lead to account takeover and unauthorized access to sensitive learning data.

Requires only user's email address.
Predictable token bypasses authentication.
Risk of account takeover and data compromise.

Live Threat

Current exploitation, exposure, and threat context

An attacker could gain unauthorized access to user accounts by exploiting a flaw in the password reset mechanism. This occurs when the system generates reset tokens using only the user's email address, without additional security measures like randomness, expiration, or rate limiting. This could allow an attacker who knows a user's email to reset their password and take control of their account.

User account access and system data.
Predictable tokens allow password reset.
Unauthorized account control and data access.

Operational Fix

Recommended remediation, mitigation, and detection steps

Given that Chamilo LMS is a web-based learning management system, application owners or platform teams are likely responsible for addressing this vulnerability. The first practical step is to identify all instances of Chamilo LMS, confirm their reachability and business criticality, and then locate the accountable owner for remediation planning.

Application owners should manage the issue.
Verify internet-facing Chamilo LMS instances.
Plan updates during maintenance windows.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Chamilo LMS?

Chamilo LMS is an open-source learning management system used by educational institutions and businesses to host courses, manage students, and track learning progress. It typically acts as a centralized web portal where users authenticate to access private training materials and personal profile data.

How does CVE-2026-33707 work?

This vulnerability falls under the Weak Password Requirements weakness class. In older versions of Chamilo LMS, the software created password reset tokens by simply performing a SHA1 hash of a user's email address. Because this process lacked randomness, it created a predictable pattern that allowed anyone who knew a user's email to generate a valid reset token independently.

Do I need to trigger a password reset for this to be a risk?

No. You do not need to trigger or request an actual password reset email for this to work. Because the token generation is a static mathematical calculation based only on the email address, an attacker can calculate the token themselves without initiating any system-level requests or interacting with the target user.

Is my Chamilo LMS instance at risk?

If your instance is reachable over the internet, it is at higher risk because the password reset service is exposed to external traffic. According to Halo Surface Signal, Chamilo LMS is frequently deployed as a public-facing service to support remote students, making these implementations likely targets for anyone seeking unauthorized account access.

How do I fix the CVE-2026-33707 vulnerability?

The primary response is to update your software. The vulnerability is resolved in Chamilo LMS versions 1.11.38 and 2.0.0-RC.3. Start by auditing your environment to find all running instances, determine which are internet-facing, and coordinate with your team to schedule an update to these secure versions.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.