AppSec guide

OWASP Top 10 Explained: The 2025 List

The OWASP Top 10 is a standard awareness document for developers and web application security. The current edition is OWASP Top 10:2025, led by Broken Access Control, with Software Supply Chain Failures and Mishandling of Exceptional Conditions added as new categories. This page lists all ten exactly as OWASP publishes them, says what each means in plain language, and links to practice tools.

Last reviewed 3 November 2026 against owasp.org. The category descriptions are our paraphrase of OWASP's text, which is licensed under Creative Commons Attribution; read the originals via the Sources links.

Updated 3 November 2026

The OWASP Top 10:2025 list

ID	Category
A01:2025	Broken Access Control
A02:2025	Security Misconfiguration
A03:2025	Software Supply Chain Failures
A04:2025	Cryptographic Failures
A05:2025	Injection
A06:2025	Insecure Design
A07:2025	Authentication Failures
A08:2025	Software or Data Integrity Failures
A09:2025	Security Logging and Alerting Failures
A10:2025	Mishandling of Exceptional Conditions

The names are copied from the list at top10.owasp.org/2025. The list writes A09 as "Logging and Alerting"; the introduction and the category page headline use an ampersand instead.

What changed from 2021

A03 Software Supply Chain Failures expands 2021's Vulnerable and Outdated Components to cover the whole ecosystem of dependencies, build systems and distribution infrastructure.
A10 Mishandling of Exceptional Conditions is a new category.
SSRF is no longer its own category; it is rolled into A01 Broken Access Control.
A02 Security Misconfiguration rose from #5 to #2; Cryptographic Failures fell from #2 to #4, Injection from #3 to #5 and Insecure Design from #4 to #6.
Renames: A07 was Identification and Authentication Failures, and A09 was Security Logging and Monitoring Failures.

A01:2025 Broken Access Control

Access control enforces policy so users cannot act outside their intended permissions. OWASP lists failures such as violating least privilege (deny by default), bypassing checks by modifying the URL or API request, viewing or editing another account by changing its identifier, missing controls on POST, PUT and DELETE, tampering with JWTs or cookies, and CORS misconfiguration. Server-Side Request Forgery (SSRF) is rolled into this category in 2025.

Defend: Deny by default, enforce authorization on the server for every request, and test with more than one role.

Practise: RBAC matrix builder, SSRF defense checklist.

Read OWASP's full A01:2025 page

A02:2025 Security Misconfiguration

A system, application or cloud service is set up incorrectly from a security perspective. OWASP lists missing hardening, unnecessary features or ports enabled, default accounts and passwords unchanged, error handling that reveals stack traces, and missing or insecure security headers. It moved from #5 in 2021 to #2.

Defend: Use a repeatable hardening process, keep development, test and production configured alike, and review cloud permissions regularly.

Practise: Security group auditor, S3 bucket policy auditor.

Read OWASP's full A02:2025 page

A03:2025 Software Supply Chain Failures

Breakdowns or compromises in building, distributing or updating software, often through vulnerable or malicious third-party code, tools or dependencies. OWASP calls it an expansion of 2021's A06 Vulnerable and Outdated Components to cover dependencies, build systems and distribution infrastructure, and says the community survey overwhelmingly voted it a top concern.

Defend: Track every component, including transitive dependencies; scan regularly; control changes across the build pipeline; harden the supply chain itself.

Practise: Package Stoplight, Audit npm dependencies.

Read OWASP's full A03:2025 page

A04:2025 Cryptographic Failures

Failures in protecting data in transit and at rest, such as old or weak algorithms and protocols, default or reused keys, keys checked into source code, missing key rotation, and certificates or trust chains not properly validated. It fell from #2 to #4.

Defend: Encrypt data in transit and at rest with current algorithms, manage and rotate keys, and validate certificates.

Practise: Harden a TLS configuration, Cryptography guide.

Read OWASP's full A04:2025 page

A05:2025 Injection

Untrusted input is sent to an interpreter, such as a database, browser or command line, and executed as commands. OWASP names SQL, NoSQL, OS command, ORM, LDAP and Expression Language injection, and notes that this category spans cross-site scripting through SQL injection. It fell from #3 to #5.

Defend: Use parameterized queries, validate and context-escape input, and add SAST, DAST and IAST testing to the pipeline.

Practise: AppSec testing chooser.

Read OWASP's full A05:2025 page

A06:2025 Insecure Design

Missing or ineffective control design. OWASP separates design flaws from implementation defects: a perfect implementation cannot fix a design that never included the needed control. It slid from #4 to #6, and OWASP sees improvement from threat modeling and secure-by-design practice.

Defend: Threat model early, write security requirements, and use secure design patterns before code is written.

Practise: Threat model tool.

Read OWASP's full A06:2025 page

A07:2025 Authentication Failures

Weaknesses that let attackers impersonate users: permitting credential stuffing and brute force, default or weak passwords, accepting known-breached credentials, weak recovery flows, plaintext or weakly hashed password storage, missing or ineffective multi-factor authentication, and poor session handling. The name changed from "Identification and Authentication Failures".

Defend: Use multi-factor authentication, check passwords against breached lists, rate-limit attempts, and manage sessions correctly.

Practise: What is MFA?, JWT lab.

Read OWASP's full A07:2025 page

A08:2025 Software or Data Integrity Failures

Code and infrastructure that treats invalid or untrusted code or data as trusted. Examples in OWASP's text include relying on plugins or libraries from untrusted sources or CDNs, CI/CD pipelines that do not verify what they pull, auto-updates without integrity checks, and insecure deserialization. OWASP says it focuses on trust boundaries at a lower level than A03.

Defend: Verify signatures on software and data, consume only trusted repositories, and review pipeline changes.

Practise: GitHub Actions security auditor.

Read OWASP's full A08:2025 page

A09:2025 Security Logging and Alerting Failures

Without logging, attacks cannot be detected, and without alerting it is hard to respond quickly. OWASP lists unlogged auditable events such as failed logins, logs that can be tampered with or are stored only locally, missing alert thresholds, and logging sensitive data. The name changed from "Security Logging and Monitoring Failures" to stress alerting; the category page headline writes it with an ampersand.

Defend: Log security-relevant events consistently, protect log integrity, ship logs off the host, and alert on what matters.

Practise: Audit log integrity checker, Log triage lab.

Read OWASP's full A09:2025 page

A10:2025 Mishandling of Exceptional Conditions

New for 2025. Programs that fail to prevent, detect or respond to unusual situations: improper error handling, logical errors, failing open and related scenarios. OWASP says this category contains 24 CWEs and that mishandling can lead to crashes, logic bugs, overflows, race conditions and fraudulent transactions.

Defend: Handle errors where they occur, fail closed, validate input, and test abnormal paths.

Practise: Threat model tool.

Read OWASP's full A10:2025 page

Frequently asked questions

What is the OWASP Top 10?

OWASP describes the Top 10 as a standard awareness document for developers and web application security that represents a broad consensus about the most critical security risks to web applications. It is a list of risk categories, not a compliance standard or a complete list of weaknesses.

Which OWASP Top 10 edition is current?

OWASP Top 10:2025. The OWASP project page says the most current released version is the OWASP Top 10 2025, with 2021 and 2017 listed as previous versions. We checked on 3 November 2026; confirm at owasp.org before citing it in an audit.

What are the OWASP Top 10 2025 categories?

A01 Broken Access Control; A02 Security Misconfiguration; A03 Software Supply Chain Failures; A04 Cryptographic Failures; A05 Injection; A06 Insecure Design; A07 Authentication Failures; A08 Software or Data Integrity Failures; A09 Security Logging and Alerting Failures; A10 Mishandling of Exceptional Conditions.

What changed from the 2021 list?

OWASP says there are two new categories and one consolidation. A03 Software Supply Chain Failures expands the former Vulnerable and Outdated Components, A10 Mishandling of Exceptional Conditions is new, and Server-Side Request Forgery was folded into A01 Broken Access Control. Security Misconfiguration rose from #5 to #2, and two categories were renamed to Authentication Failures and Security Logging and Alerting Failures.

Is the OWASP Top 10 a compliance requirement?

It is not a law or a certification. Some standards and customer contracts reference it as a baseline for secure development, so check what binds you. This guide is general information, not legal advice.

Is there a separate OWASP Top 10 for APIs or LLMs?

Yes. OWASP publishes separate lists for API security and for large language model applications. This guide covers only the web application Top 10. PlayCISO has pages for the OWASP LLM Top 10 and an API security hub.

How is the list built?

OWASP says the Top 10 is data-informed but not blindly data-driven: it ranked 12 categories from contributed testing data and allowed two to be promoted by a community survey, because testing data looks at the past and some risks are hard to test for.

Where should a team start?

Start with A01 Broken Access Control, which OWASP keeps at #1, and A07 Authentication Failures, then add dependency tracking for A03. Use a threat model for A06 and a testing plan for A05. The links under each category point to practice tools.