Password Reset Vulnerability in Chamilo LMS Affects User Authentication

CVE-2026-33707

What is CVE-2026-33707?

Chamilo LMS has a security flaw in its default password reset mechanism that allows potential attackers to exploit user accounts easily. The vulnerability exists because tokens generated for password resets are created using a predictable method (sha1 of the user's email) without incorporating randomness, expiration, or rate limiting. As a result, an attacker with knowledge of a user's email could craft a valid reset token, enabling them to change the user's password without any authentication. To mitigate this risk, users are advised to upgrade to Chamilo LMS versions 1.11.38 or 2.0.0-RC.3 where this issue has been addressed.

References