OWASP Top 10:2025 for web applications: what moved and why

What it is

The OWASP Top 10 is a community-produced awareness document listing the most critical risk categories for web applications. It combines contributed testing data with a community survey, so that emerging problems not yet visible in tool data can still be ranked. The 2025 edition is the eighth, following 2021. It groups many individual weaknesses (CWEs) into ten categories.

Why it matters

The Top 10 is not a standard, but it is cited in contracts, procurement questionnaires, secure coding training and many testing tools. When the list changes, training plans and scanner reports change with it. For students it is often the first structured view of application security; for engineers it is a common language with developers and auditors.

Key ideas and what changed

• Access control remains the biggest problem. Missing or incorrect authorisation checks, insecure direct object references and privilege escalation are still widespread. Server-side request forgery (SSRF), a separate category in 2021, is now treated as an access control failure: the server is tricked into reaching something the attacker should not.
• Misconfiguration rises. More behaviour is driven by configuration (cloud services, frameworks, containers), so mistakes in defaults, permissions and exposed admin features are more common.
• Supply chain becomes a full category. The 2021 "vulnerable and outdated components" idea is widened to the whole chain: dependencies, build systems, package registries and distribution. This reflects real attacks on build pipelines and packages. See SBOM and SLSA.
• Exceptional conditions are new. A10 covers failing open, leaking details in error messages, inconsistent error handling and logic flaws when unusual input or resource exhaustion occurs.
• Alerting, not just logging. A09’s rename makes the point that logs nobody watches do not help. Alerts must reach someone who can act.

How practitioners apply it

1. Use it for awareness and training, not as a complete testing checklist. For verification, use the OWASP Application Security Verification Standard (ASVS) and testing guides.
2. Centralise authorisation and deny by default. Write tests that try to access other users’ objects.
3. Treat configuration as code. Review infrastructure templates, framework settings and cloud policies the same way you review source code.
4. Own your dependencies. Keep an SBOM, pin and verify packages, and protect the CI/CD pipeline.
5. Test failure paths. Fuzz inputs, simulate timeouts and check that errors fail closed and reveal nothing sensitive.

To see why A01 stays on top, picture an online shop where the URL for an order is /orders/1042. If the server only checks that you are logged in, and not that order 1042 belongs to you, changing the number reveals other customers’ orders. No scanner signature will reliably catch this, because the request looks completely normal. The fix is an ownership check on the server for every object, and the test is to log in as two different users and try to cross the boundary. The same pattern applies to APIs used by mobile apps, which are often less carefully protected than the web front end.

Tip: Network controls still help. A web application firewall and egress filtering (see firewall types) can limit SSRF and injection impact, but they do not fix the underlying code.

Limitations and open questions

• Data bias. Contributed data reflects what tools can find easily. Design and logic flaws are under-counted, which is why the survey exists.
• Categories are broad. One category can hide very different problems, so ranking within the list says little about your own application.
• Not a compliance target. "OWASP Top 10 compliant" has no formal meaning. Contracts that require it should instead reference a verification level in ASVS.
• APIs differ. Applications that are mostly APIs face somewhat different risks, which OWASP covers in its separate API Security Top 10.
• AI-specific risks are covered separately by the OWASP Top 10 for LLM applications.