Cryptographic Failure

Cryptographic failures occur when applications use weak, outdated, or incorrectly implemented cryptography to protect sensitive data. Common examples include using MD5 or SHA-1 for password hashing, storing passwords without salting, using ECB mode for symmetric encryption, or transmitting sensitive data over HTTP.

OWASP renamed this category from Sensitive Data Exposure in 2021 to better reflect that the root cause is often a crypto failure rather than just missing encryption.