RC4 bias
RC4's output is not uniformly random, and the non-randomness shows up in the very first bytes.
In 2000 Fluhrer and McGrew showed that RC4's keystream has statistical correlations no ideal cipher would have. In 2001 Mantin and Shamir found that the second output byte is zero about twice as often as it should be. This was more than an academic curiosity: in TLS, a cookie sent at the start of many encrypted streams could be recovered from the biases. RFC 7465 banned RC4 from TLS in 2015, more than a decade after the bias was known.