Cryptographic Failures
Was 2nd in 2021 and is 4th in 2025. Cleartext transport, weak password storage, hardcoded keys, and tokens that are only encoded. OWASP reported about 3.80% of applications had one or more of 32 CWEs in this category. Exposure of sensitive data is the usual…
OWASP rank: 4
Practical checks
- Confirm TLS on every host that sets a session, including redirects and asset hosts
- Look for tokens, keys, and personal data in JavaScript, localStorage, and logs you are allowed to see
- Note password reset and magic links that put secrets in URLs
- Do not claim a hash is weak unless you can cite the algorithm the server actually uses
- Treat a leaked key as a finding only when you can show what it unlocks inside scope