I don't know if this is the worst, since I've seen some that were pretty bad, but:
Years ago, a place I worked at brought in a system called FOCUS. Don't know if it's still around or not. It's great for reporting, and we developed and taught perhaps a thousand or two non-IT people how to produce their own reports. Very handy. They could do the basic reports, some could do the medium-hard stuff, and IT could help with the harder stuff.
All of the data for reporting was copied regularly to shadow databases in FOCUS' own format. For the more sensitive data, we set the secure option, which encrypted the data. All well and good.
So, one day my boss calls me in, and we've lost the password to one of the sensitive databases. It's going to be hard to reproduce the data in this case, so he asks me to see if I can break the security. I had no experience as a hacker, so it took me about 5 or 6 hours to hand him the password. I started by creating some test files, and encrypting them with different passwords. I found that changing one character in the password would change two bytes in the encrypted file, specifically, the high nybble of one byte, and the low nybble of another byte. Hmmmm, says I. Sure enough, they stored the password somewhere in the first 80 bytes of the encrypted, but obfuscated the password by splitting the bytes into nybbles, and storing them in predictable places.
It didn't take long after that to write a REXX script that ran under the VM/CMS system and would tell us the password of any encrypted database.
That was a long time ago - in the early nineties, and I'm sure they've since fixed this problem. Well, pretty sure.