CVE-2026-116071

The record

rotki before 1.44.2 contains a weak key derivation vulnerability that allows attackers to brute-force backups because the premium sync key is a single unsalted SHA-256 of the user password. Attackers who obtain an uploaded backup blob can run GPU-parallel offline password guessing and decrypt the database containing exchange API keys, secrets, wallet addresses and transaction history.

Affected packages

Related vulnerabilities

• CVE-2026-13576 CallBackery versions before 0.62.0 for Perl store user passwords as unsalted HMAC-SHA1… CWE-916
• CVE-2026-118991 CallBackery versions before 0.62.0 for Perl encrypt configuration backups with the padded… CWE-916
• CVE-2026-65629 Use of Password Hash With Insufficient Computational Effort in the jose library allows an… CWE-916
• CVE-2026-116054 A security vulnerability has been detected in SH3. CWE-916
• CVE-2025-30049 The CGM CLININET application stores user passwords as unsalted MD5 hashes. CWE-916
• CVE-2026-112026 A security vulnerability has been detected in light0011 cms… CWE-916
• CVE-2026-86670 A flaw has been found in aircheng-org iWebShop-5 up to 5.15. CWE-916
• CVE-2026-81704 openssl_encrypt versions before 1.4.9 contain a weak key derivation vulnerability in the… CWE-916