CVE-2026-116071Medium· 5.9▾ Sunlitrotki before 1.44.2 contains a weak key derivation vulnerability that allows attackers to brute-force backups because the premium sync key is a single unsalted SHA-256 of the user password. Attackers who obtain an uploaded backup blob ca…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 32.5 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
rotki before 1.44.2 contains a weak key derivation vulnerability that allows attackers to brute-force backups because the premium sync key is a single unsalted SHA-256 of the user password. Attackers who obtain an uploaded backup blob can run GPU-parallel offline password guessing and decrypt the database containing exchange API keys, secrets, wallet addresses and transaction history.
rotki < 1.44.2Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2023-0567High· 7.7In PHP 8.0.X before 8.0.28, 8.1.X before 8.1.16 and 8.2.X before 8.2.3, password_verify() function may accept some invalid Blowfish hashes as valid
CVE-2026-116054Low· 2.2SH3 Módulo de Gestão/Módulo de Arrecadação weak password hash
CVE-2025-30049High· 8.2Use of Unsalted MD5 Password Hashes in CGM CLININET
CVE-2026-112029Low· 2.5diem-project diem SHA1 PluginDmUser.class.php weak password hash
CVE-2026-112026Low· 3.7light0011 cms UserModel.class.php sha1 weak password hash
CVE-2026-111330Medium· 5.9JuggleIM im-server through 1.8.16 Weak Password Hashing via Unsalted SHA-1