OWASP Top 10 (Web) (2025)

Access-control failures including IDOR, missing authorization, JWT/SAML weaknesses. Maintains the #1 position from 2021. Server-Side Request Forgery (SSRF) was rolled into this category in 2025.

Insecure defaults, missing hardening, exposed admin/debug interfaces, misconfigured cloud services. Moved up from #5 in 2021 to #2 in 2025.

Expansion of A06:2021 (Vulnerable and Outdated Components) to cover compromises across the entire ecosystem of software dependencies, build systems, and distribution infrastructure.

Weak crypto, missing crypto, plaintext sensitive data, weak key management.

SQL injection, command injection, LDAP injection, NoSQL injection, XSS (reflected/stored/DOM), template injection. XSS is included as injection.

Lack of threat modeling, missing security requirements, fundamentally insecure architecture.

Weak authentication, broken session management, credential stuffing tolerance, MFA bypass.

Insecure deserialization, unsigned updates, untrusted CI/CD pipelines, integrity check failures.

Inadequate logging, missing alerting, no audit trail, log-injection vulnerabilities.

New in 2025. Poor error and exception handling that leads to unpredictable or insecure behavior. Replaces SSRF as a standalone category, which moved into A01.