OWASP Top 10 2025: Complete Breakdown of the Latest Web Security Vulnerability Rankings

Occurs when users — or attackers — can perform actions or access resources they should not be permitted to. Includes bypassing authorization checks, exploiting direct object references (IDOR), and SSRF (now merged here). Remains #1 because authorization logic is fragile across frameworks, APIs, microservices, and cloud systems. Affects ~3.73% of tested applications.

Misconfigurations in software stacks, frameworks, platforms, containers, cloud environments, or application settings that leave systems exposed. Moved up to #2 as modern applications rely heavily on configuration. A single incorrect setting — a public bucket, default credentials, or a missing security header — can cause massive data exposure.

New category expanded from 'Vulnerable and Outdated Components.' Covers failures across the software ecosystem: dependencies, build systems, distribution infrastructure, package management, and trust in third-party components. Impact of exploitation is high as attackers increasingly target supply chains for scalable, wide-reach compromise.

Failures around encryption, key management, use of secure channels, or cryptographic algorithms. The attack surface continues to grow across cloud, mobile, and IoT environments. Weak or misused cryptography leads directly to data exposure or system compromise — from hardcoded keys and weak algorithms to missing TLS enforcement.

Injection vulnerabilities occur when untrusted data is sent to an interpreter as part of a command or query, enabling attackers to execute unintended commands. Covers SQL injection, XSS (reflected, stored, DOM-based), OS command injection, LDAP injection, and NoSQL injection. Still frequently exploited despite dropping to #5.

Focuses on architectural and design flaws when threats, abuse cases, or business logic are not addressed during early development. Retained from the 2021 edition. Fixing design flaws late in the development cycle is extremely costly. Requires threat modeling, trust boundary definitions, and security requirements from the start.

Relates to vulnerabilities in authentication mechanisms, session management, identity lifecycle, and improper credential handling. Formerly 'Identification & Authentication Failures.' Despite improving frameworks, custom code and integration gaps still produce authentication vulnerabilities enabling account takeover, impersonation, or session hijacking.

Focuses on failures to verify the integrity of code, libraries, data, or configuration within systems. Distinct from supply chain risks (A03). Even if dependencies are trusted, absent integrity checks — unsigned updates, unverified deserialization — allow attackers to insert malicious code or corrupt data flows.

Emphasizes not only logging but the alerting and monitoring side of security — because logs without alerting and action have very limited value. As environments grow more complex (microservices, cloud, containers), detecting incidents requires integrated, actionable logging and monitoring. Underrepresented in test data but high in community concern.

New category for 2025. Focuses on system behavior under abnormal conditions: exceptions, unexpected input, fail-open logic, and error handling vulnerabilities. Attackers exploit edge cases and exception paths not covered by design or testing. A system that fails open instead of failing safely is a growing attack surface.