Weak Cryptography
Weak cryptography is the use of broken, outdated, or misconfigured cryptographic algorithms and practices — such as MD5, SHA-1, DES, small keys, or hardcoded keys — that fail to adequately protect data, letting attackers decrypt, forge, or crack values that were assumed to be secure.
Weak cryptography covers any situation where cryptography is present but does not provide the security it should. This includes using algorithms known to be broken or insufficient (MD5 and SHA-1 for security purposes, DES/3DES, RC4), inadequate key sizes, insecure modes such as ECB, missing salting for password hashing, predictable or hardcoded keys and IVs, and disabled certificate validation. The result is that encrypted or hashed data can be reversed, forged, or brute-forced.
Cryptography also weakens over time: algorithms and key lengths that were once safe become practical to attack as computing power grows and new cryptanalysis emerges. Correct use means choosing modern, vetted primitives (for example AES-GCM for encryption, SHA-256 or better for integrity, and purpose-built password hashing such as bcrypt, scrypt, or Argon2), generating keys and nonces from a cryptographically secure random source, and managing keys separately from the data they protect.
This class of issue sits under the OWASP Top 10 category "Cryptographic Failures" and maps to CWE-327 (broken or risky cryptographic algorithm) and related weaknesses. It matters because a single weak choice can silently undermine the confidentiality or integrity of an entire system — passwords, tokens, and sensitive records that appear protected may in fact be trivially recoverable.