CVE Intelligence

Rotki Rotki vulnerabilities

🔔 Create alert RSS Version checker

Published CVEs affecting Rotki Rotki: 1 record(s), with affected versions and fixes.

CVE-2026-116071 Medium · 5.9 CWE-916 Oct 25, 2026
rotki before 1.44.2 Weak Key Derivation for Premium Cloud Backup Encryption
rotki before 1.44.2 contains a weak key derivation vulnerability that allows attackers to brute-force backups because the premium sync key is a single unsalted SHA-256 of the user password. Attackers who obtain an uploaded backup blob can run GPU-parallel offline password guessing and decrypt the database containing exchange API keys, secrets, wallet addresses and transaction history.