Is CVE-2026-116071 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-116071?

CVE-2026-116071 has a CVSS v3 severity of MEDIUM (5.9).

Back

CVE-2026-116071

Description

rotki before 1.44.2 contains a weak key derivation vulnerability that allows attackers to brute-force backups because the premium sync key is a single unsalted SHA-256 of the user password. Attackers who obtain an uploaded backup blob can run GPU-parallel offline password guessing and decrypt the database containing exchange API keys, secrets, wallet addresses and transaction history.