CVE-2026-116071
MEDIUM
NVD
CVSS Score
5.9
Severity
MEDIUM
Published
Oct 25, 2026
Vendor
unknown
Description
rotki before 1.44.2 contains a weak key derivation vulnerability that allows attackers to brute-force backups because the premium sync key is a single unsalted SHA-256 of the user password. Attackers who obtain an uploaded backup blob can run GPU-parallel offline password guessing and decrypt the database containing exchange API keys, secrets, wallet addresses and transaction history.