CVE Intelligence

Rotki vulnerabilities

🔔 Create alert RSS

Published CVEs affecting Rotki products: 1 record(s), with severity, exploitation and fixes.

Rotki 1

Exploited only (KEV) →

CVE-2026-116071 Medium · 5.9 CWE-916 Oct 25, 2026
rotki before 1.44.2 Weak Key Derivation for Premium Cloud Backup Encryption
rotki before 1.44.2 contains a weak key derivation vulnerability that allows attackers to brute-force backups because the premium sync key is a single unsalted SHA-256 of the user password. Attackers who obtain an uploaded backup blob can run GPU-parallel offline password guessing and decrypt the database containing exchange API keys, secrets, wallet addresses and transaction history.