In OSS/Auth/Password.php, you've got this:

                case self::HASH_MD5_SALTED:
                    return md5( $pw . $config['pwhash'] );
                    break;
                case self::HASH_SHA1:
                    return sha1( $pw );
                    break;
                case self::HASH_SHA1_SALTED:
                    return sha1( $pw . $config['pwhash'] );
                    break;

Since $config['pwhash'] is the name of the hash method, the "random" salt is the hardcoded string md5.salted or sha1.salted.

(This can be checked by eg. setting a ViMbAdmin password to "12345678" and seeing that the resultant hash in the database is 449a41df7f93623c19b80f8fcb9f7143, which is MD5("12345678md5.salted").)

This should probably be somewhat more random to provide the intended benefit.