OWASP Top 10:2025: the ten web application risks

The OWASP Top 10:2025 lists ten web application security risks, A01 to A10, from Broken Access Control to Mishandling of Exceptional Conditions. OWASP calls it a standard awareness document for developers and web application security. This article summarizes each category as OWASP’s own 2025 pages describe it, in OWASP’s order, with no ranking of our own added.

What is the OWASP Top 10:2025?

OWASP says the Top 10 “represents a broad consensus about the most critical security risks to web applications.” OWASP says the 2025 version “includes updates based on the latest data and security trends.”

Each category page gives a background, a score table and a description. The paragraphs below follow the background and description sections of those pages.

What are the ten web application risks, in OWASP’s order?

A01: Broken Access Control

OWASP says access control enforces policy so that users cannot act outside their intended permissions. Failures typically lead to unauthorized information disclosure, modification or destruction of data, or performing a business function outside the user’s limits. The category keeps the #1 position, and OWASP reports that every application tested had some form of it. One example it gives is an accessible API with missing access controls for POST, PUT and DELETE, which connects to API sprawl and the shadow and zombie API attack surface.

A02: Security Misconfiguration

OWASP defines this as a system, application or cloud service set up incorrectly from a security perspective, creating vulnerabilities. It moved up from #5 in the previous edition. The examples include unnecessary features that are enabled, default accounts and passwords that are still enabled and unchanged, and servers that do not send security headers.

A03: Software Supply Chain Failures

OWASP describes these as breakdowns or other compromises in the process of building, distributing or updating software. They are often caused by vulnerabilities or malicious changes in third-party code, tools or other dependencies. The category first appeared in the 2013 list as “Using Components with Known Vulnerabilities” and has since widened. See also our supply chain attack entry and the rise of supply chain cyber attacks.

A04: Cryptographic Failures

This category moved down two positions to #4. OWASP says it focuses on the lack of cryptography, insufficiently strong cryptography, leaking of cryptographic keys and related errors. It also says passwords, credit card numbers, health records, personal information and business secrets need extra protection.

A05: Injection

OWASP defines an injection vulnerability as an application flaw that allows untrusted user input to be sent to an interpreter, which then executes parts of that input as commands. The category fell from #3 to #5. OWASP says it had the greatest number of CVEs of any category and includes cross-site scripting with more than 30k CVEs and SQL injection with more than 14k CVEs.

A06: Insecure Design

OWASP describes insecure design as a broad category of weaknesses expressed as “missing or ineffective control design.” It slid from #4 to #6. OWASP stresses the difference between insecure design and insecure implementation, and says insecure design is not the source for all other Top Ten risk categories.

A07: Authentication Failures

The category stays at #7 with a slight name change. OWASP says the weakness is present when an attacker can trick a system into recognizing an invalid or incorrect user as legitimate. Its examples include credential stuffing, brute force attacks that are not quickly blocked, and default, weak or well-known passwords.

A08: Software or Data Integrity Failures

Continuing at #8, this category covers the failure to maintain trust boundaries and verify the integrity of software, code and data artifacts. OWASP says it works at a lower level than Software Supply Chain Failures. One example is an application that relies on plugins, libraries or modules from untrusted sources, repositories and content delivery networks.

A09: Security Logging and Alerting Failures

This category retains #9, and the name now stresses alerting. OWASP says that without logging and monitoring, attacks and breaches cannot be detected, and without alerting it is very difficult to respond quickly. It adds that the category will always be underrepresented in the data, with only 723 CVEs in the CVE and CVSS data.

A10: Mishandling of Exceptional Conditions

This is a new category for 2025. OWASP says it happens when programs fail to prevent, detect and respond to unusual and unpredictable situations, which leads to crashes, unexpected behavior and sometimes vulnerabilities. It focuses on improper error handling, logical errors and failing open. OWASP’s prevention advice includes rolling back a transaction part way through, also known as failing closed.

What numbers does OWASP give for its categories?

The category pages carry score tables and background figures. These are the ones OWASP states in the text of its pages.

How did the ranking move compared with the earlier edition?

Several category pages describe how a category moved. The table restates what each page says.

What can a security team ask about its own applications?

These questions are derived from the stated descriptions above. They are checks, not OWASP recommendations.

• Does every API method have an access control, as A01 describes?
• Are default accounts and passwords still enabled anywhere, as A02 lists?
• Do we track the versions of every component we use, including nested ones, as A03 asks?
• Do our logs record failed logins as well as successful ones, as A09 describes?

Knowing which applications and services are exposed is the starting point for all of these. Our EASM 101 guide explains how external attack surface management approaches that question. For the same exercise on AI systems and on code weaknesses, see our posts on the OWASP Top 10 for LLM applications and the CWE Top 25.