YTYK You think you know

Card 10 of 18 The classics, demoted ●●○ Working knowledge

A04: cryptographic failures, down to fourth

Cryptographic Failures fell from #2 to #4. It covers the absence of cryptography, cryptography that is not strong enough, leaked keys and related errors — around 32 CWEs, affecting about 3.80% of applications tested.

Why it is like this

The common failures are no longer exotic algorithm breaks. Three of the most frequent CWEs in the category concern weak random number generation — predictable output where unpredictability was the whole point.

Not to be confused with

Choosing a bad cipher. Most of this category is about using crypto wrongly or not at all, and a weak PRNG behind a token or a reset link defeats correct cryptography everywhere else.

In practice

It was renamed from *Sensitive Data Exposure* back in 2021 for the same reason the 2025 renames happened: the old name described the symptom, the new one the cause.

Source: OWASP Top 10:2025 — A04:2025 Cryptographic Failures. Read on .

The OWASP Top 10:2025 is © 2021-2025 the OWASP Top 10 Team and is licensed under a Creative Commons Attribution 3.0 Unported Licence. These cards are independent commentary written in our own words. ytyk.org is not affiliated with or endorsed by the OWASP Foundation.

Predict Check yourself

Which of these is the most common shape of an A04 finding, by the project's own data?

  1. A weak or predictable pseudo-random number generator behind something that needed to be unguessable.
  2. A broken cipher such as DES still in production use.
  3. A certificate validated against the wrong host.
  4. Sensitive data written to a log file.
Show the answer

A weak or predictable pseudo-random number generator behind something that needed to be unguessable.

Three of the category's most common CWEs are about entropy and predictable generators. Certificate host mismatch is A07, and sensitive data in logs is A09.