Cryptographic Failures
Sensitive data exposed because cryptography is missing, weak, or misused.
What it is
Cryptographic Failures moves down from A02:2021 to A04:2025 as Security Misconfiguration and Supply Chain Failures overtake it in prevalence. The category covers any path by which sensitive data is exposed because of inadequate cryptographic protection. Manifestations include missing encryption in transit or at rest, weak algorithms (DES, MD5, SHA-1 for passwords), hardcoded credentials, weak or predictable random number generation, and improper key management. The consequences of disclosure are often immediate and unrecoverable: leaked passwords cannot be unleaked.
Common patterns
- •Hashing passwords with fast algorithms (MD5, SHA-256) instead of bcrypt, argon2, or scrypt.
- •AES with ECB mode (visible patterns) or CBC without HMAC (padding oracle vulnerabilities).
- •Hardcoded API keys, database passwords, or signing secrets in source code.
- •Math.random or other non-cryptographic PRNGs used for tokens, session IDs, or salts.
- •HTTP endpoints transmitting credentials, tokens, or PII without TLS.
- •Stack traces, debug pages, or error responses that include sensitive system or user data.
What Deva detects
Deva matches algorithm and mode constructors across language ecosystems and flags use of broken or unsuitable primitives in security contexts. The scanner runs high-confidence regex detectors for AWS keys, Stripe tokens, GitHub PATs, OpenAI and Anthropic keys, and other credential formats. Error-handling rules flag handlers that return stack traces, debug objects, or full request bodies to clients.
CWE detection guides
Real-world examples
| Year | Incident | What happened |
|---|---|---|
| 2017 | Equifax (147M records) | Sensitive consumer data was exfiltrated in part because of unencrypted internal traffic and credentials stored in plaintext on internal systems. Initial access was via an unpatched Apache Struts vulnerability, but the impact was amplified by cryptographic failures downstream. |
| 2022 | LastPass (encrypted vault leak) | Encrypted password vaults were exfiltrated from a backup. Vault contents were protected by user master passwords. Master passwords with weak entropy and old (pre-2018) hashing iterations remained crackable offline. |
Compliance framework impact
- •NIST 800-53 SC-13 Cryptographic Protection, IA-5 Authenticator Management
- •PCI-DSS v4.0 Req 3.6 Cryptographic key management, Req 8.3.2 Strong cryptography
- •HIPAA 164.312(a)(2)(iv) Encryption and Decryption, 164.312(e)(2)(ii) Encryption in transit
- •FedRAMP SC-13 Cryptographic Protection
- •GDPR Article 32 (pseudonymization, encryption)
Deva detects the cryptographic failures patterns above at write time, alongside 970+ other CWE rules, with fixes mapped to the compliance controls each finding touches.