The BO_CAST plugin for BO2k has a vulnerability that causes any password to generate the same CAST-256 key.