CVE-2026-116071

MEDIUM 5.9

rotki before 1.44.2 Weak Key Derivation for Premium Cloud Backup Encryption

CVSS Score

5.9

EPSS Score

0.0%

EPSS Percentile

0th

rotki before 1.44.2 contains a weak key derivation vulnerability that allows attackers to brute-force backups because the premium sync key is a single unsalted SHA-256 of the user password. Attackers who obtain an uploaded backup blob can run GPU-parallel offline password guessing and decrypt the database containing exchange API keys, secrets, wallet addresses and transaction history.

CWE	CWE-916
Vendor	rotki
Product	rotki
Published	Oct 25, 2026

Stay Ahead of the Next One

Get instant alerts for rotki rotki

Be the first to know when new medium vulnerabilities affecting rotki rotki are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Affected Versions

rotki / rotki

0 < 1.44.2

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/rotki/rotki/issues/13393 github.com: https://github.com/rotki/rotki github.com: https://github.com/rotki/rotki/pull/13401 github.com: https://github.com/rotki/rotki/blob/v1.44.1/rotkehlchen/crypto.py#L17-L45 github.com: https://github.com/rotki/rotki/blob/v1.44.1/rotkehlchen/data_handler.py#L263-L294 github.com: https://github.com/rotki/rotki/releases/tag/v1.44.2 vulncheck.com: https://www.vulncheck.com/advisories/rotki-before-1.44.2-weak-key-derivation-for-premium-cloud-backup-encryption

Credits

George Chen