The security of the cryptosystem based on projection-onto-constraint-sets (POCS) and a 4f correlator is examined. A method of known-plaintext attack based on phase retrieval algorithm from two-intensity information is presented. In the field of information security the cryptosystem based on POCS and the 4f correlator is a typical approach. But its decryption system can be equivalent to the standard 4f system and the encryption and decryption keys are identical. So this linearity characteristic opens avenues of attacks. With the known-plaintext attack method, an attacker is able to break down the cryptosystem by only a pair of input phase data and output intensity data.