Executive Summary
OWASP released the 2025 edition of its Top 10 web application security risks in November 2025, replacing the 2021 list as the current industry standard. The update introduces two new categories — Software Supply Chain Failures and Mishandling of Exceptional Conditions — reflecting growing concern over compromised dependencies, insecure CI/CD pipelines, and poor error handling in production systems. Broken Access Control retains the top spot for the second consecutive release, while Security Misconfiguration climbs to second place, underscoring how cloud misconfigurations continue to expose organizations at scale. Notably, Injection has fallen to fifth place as parameterized queries and modern frameworks reduce its real-world prevalence, and Server-Side Request Forgery has been absorbed into Broken Access Control rather than standing alone.
This guide breaks down each of the ten categories with practical, actionable testing methods — spanning automated scanning for mechanical vulnerabilities like injection and misconfiguration, to manual review and threat modeling for judgment-driven risks like insecure design and access control. The core takeaway is that no single testing approach covers the full list. Effective application security requires a continuous program combining automated tools, manual assessment, and design-stage threat modeling — using the OWASP Top 10 as a prioritization framework rather than a one-time compliance checklist or complete security guarantee.
If you tested a web app against the 2021 OWASP list last year and figured you were covered for a while, it’s worth revisiting that assumption. OWASP released the 2025 edition at Global AppSec USA in November 2025, and it isn’t a light refresh. Two entirely new categories showed up, several old ones got merged or renamed, and the ranking shuffled in ways that should change where security teams actually spend their testing hours.
This guide walks through what’s changed, why it changed, and — more usefully — how to actually test for each category rather than just memorize the list.
Why the List Moves at All
The OWASP Top 10 isn’t a static checklist someone wrote once and left alone. It’s rebuilt roughly every three to four years from a mix of contributed vulnerability data (CWEs mapped from real incidents and scans) and a community survey of practitioners. That combination matters: some categories, like injection, show up heavily in scan data because they’re mechanical and easy to detect. Others, like logging failures, barely show up in scan data at all because nobody scans for “did anyone notice this happened” — so those get pulled in through the survey instead.
That’s also why this year’s list looks different from a pure vulnerability-count ranking. Broken Access Control has held the top spot since 2021, but Security Misconfiguration jumped to second, and two brand-new categories — Software Supply Chain Failures and Mishandling of Exceptional Conditions — replaced older, narrower entries. Server-Side Request Forgery, which had its own slot in 2021, got folded into Broken Access Control because, structurally, SSRF is really just a server making a request it shouldn’t have permission to make.
With that context, here’s the full 2025 list and what testing each one actually looks like in practice.
A01:2025 — Broken Access Control
Still number one, and for good reason: this is where an attacker does something the app never intended to let them do — viewing another user’s invoice by changing an ID in the URL, hitting an admin endpoint directly, or escalating a role through a parameter the frontend forgot to hide.
Testing this well means going past the UI. Map every role in the system, then try every sensitive action as a lower-privileged user using direct API calls, not just the buttons the interface shows you. Object-level checks matter most: if /api/orders/1042 returns your order, does /api/orders/1043 return someone else’s? Automated scanners catch some of this, but a lot of broken access control only shows up when a human thinks through what the business logic was supposed to prevent.
Because SSRF is now a subset of A01, your access control testing must also include fuzzing inputs that accept URLs or file paths to ensure the server cannot be forced to make unauthorized requests to internal metadata endpoints or private network loops.
A02:2025 — Security Misconfiguration
This jumped to second place partly because it’s everywhere and partly because cloud environments made it easier to get wrong at scale. Default credentials left in place, verbose error pages leaking stack traces, open S3 buckets, unnecessary services running, permissive CORS policies — none of these require clever exploitation, just someone finding the door left open.
Test by comparing the actual deployed configuration against a hardened baseline, not against what the config file says it should be. Check cloud storage permissions directly, look at HTTP response headers for what they’re revealing, and don’t skip the boring stuff like whether directory listing is enabled or whether debug mode made it to production.
A03:2025 — Software Supply Chain Failures
New to the list, and honestly overdue given how many major breaches in the last few years traced back to a compromised dependency rather than a flaw in the organization’s own code. This covers vulnerable or malicious third-party libraries, compromised build pipelines, unsigned packages, and CI/CD systems with more access than they need.
Software composition analysis tools are the starting point — generate a software bill of materials and check every dependency against known vulnerability databases. But don’t stop at scanning; review your CI/CD pipeline’s permissions the same way you’d review an application’s access control, and verify that packages are pulled from trusted, pinned sources rather than resolved dynamically at build time.
A04:2025 — Cryptographic Failures
Formerly higher-profile as “Sensitive Data Exposure,” this category is about data protection failing at the crypto layer: weak or outdated algorithms, hardcoded keys, missing encryption for data in transit, or poor key management.
Testing here is partly manual code review and partly traffic inspection. Check whether TLS is enforced everywhere, not just on the login page. Look for hardcoded secrets in source repositories and config files. Confirm sensitive fields — passwords, tokens, personal data — are actually encrypted at rest and not just assumed to be because “it’s in the database.”
A05:2025 — Injection
Injection dropped to fifth, which surprises people who remember it as the perennial number one. That drop doesn’t mean it’s less dangerous when it happens — it still enables full data compromise — it means better use of parameterized queries and modern frameworks has reduced how often it’s exploitable in well-built apps.
Test with both automated fuzzing and manual probing across every input point: form fields, URL parameters, headers, file uploads, and API request bodies. Don’t only check SQL injection; test for command injection, LDAP injection, Cross-Site Scripting (XSS) and NoSQL injection depending on your stack. Parameterized queries and proper input validation remain the fix — there’s no clever workaround that beats just not concatenating user input into commands.
A06:2025 — Insecure Design
This slid from fourth to sixth, reflecting slow but real progress in secure-by-design practices industry-wide. It covers flaws baked into the architecture itself — a password reset flow with no rate limiting, a checkout process that trusts client-side price data, missing threat modeling before a feature ships.
You can’t scan your way to finding this one. It requires threat modeling sessions during design, not after deployment, plus abuse-case testing: instead of asking “does this feature work,” ask “what happens if someone tries to misuse this feature on purpose.”
A07:2025 — Authentication Failures
Renamed from Identification and Authentication Failures, this category hasn’t moved in the rankings and remains a top driver of account takeover. Weak password policies, missing multi-factor authentication, predictable session tokens, and flawed credential recovery flows all live here.
Test by attempting credential stuffing against your own login with known-breached password lists, checking whether session tokens are properly invalidated on logout, and verifying MFA can’t be bypassed through an alternate flow like a password-reset shortcut.
A08:2025 — Software or Data Integrity Failures
This covers trust placed in something that wasn’t verified — unsigned software updates, insecure deserialization, CI/CD pipelines that accept unverified code changes. While supply chain flaws (A03) target your external pipeline, integrity failures (A08) focus on runtime flaws.
Test these endpoints by supplying tampered serialized objects, manipulating client-side state tokens (like JWTs without signature checks), and intercepting internal update mechanisms.
A09:2025 — Security Logging and Alerting Failures
Renamed from “Logging and Monitoring” to emphasize the alerting half specifically — OWASP’s own reasoning is that logs nobody looks at, and nobody gets alerted about, provide close to zero security value even if they’re technically complete.
Testing this means simulating an attack and timing how long it takes for someone to notice, not just checking that log files exist. Verify that failed login attempts, privilege escalations, and access control violations generate alerts that actually reach a human, and that logs contain enough context to investigate an incident rather than just a timestamp and a status code.
A10:2025 — Mishandling of Exceptional Conditions
Brand new for 2025, and it’s a genuinely useful addition. This category is about what happens when things go wrong in unexpected ways — an application failing open instead of failing closed, an error message leaking a stack trace with internal file paths, or code continuing to execute in an undefined state after catching an exception it didn’t really handle.
Test by deliberately breaking things: send malformed input, kill a dependent service mid-transaction, exhaust memory or connection limits, and watch what the application does. The failure mode matters as much as whether it fails — a payment system that fails open and processes an unverified transaction is a much bigger problem than one that simply times out.
Building This Into an Actual Testing Program
Treating the Top 10 as a one-time checklist misses the point. It’s designed as a starting framework for prioritizing a continuous program: recurring automated scans for the mechanical categories (injection, misconfiguration, supply chain), paired with periodic manual testing and threat modeling for the categories that require human judgment (access control, insecure design, exception handling). Neither approach alone covers the list — automated tools miss business logic flaws, and manual testers can’t realistically cover every input combination a fuzzer can.
The list also isn’t a complete security framework on its own, and OWASP has never claimed it was. It’s a prioritization tool built from real incident data and practitioner input, meant to point limited testing resources at what’s currently causing the most damage — which is exactly why it changes every few years instead of staying fixed.
Frequently Asked Questions
Q:1 Is the OWASP Top 10 2025 the official successor to the 2021 list?
Answer : Yes. There was no separate “2024” list — the 2025 edition, released in November 2025, directly replaces 2021 as the current standard.
Q:2 What are the two brand-new categories in 2025?
Answer Software Supply Chain Failures (A03) and Mishandling of Exceptional Conditions (A10) are both new additions that didn’t exist as standalone categories in 2021.
Q:3 Why did Injection drop from a top spot to fifth place?
Answer : Wider adoption of parameterized queries and modern frameworks with built-in protections has reduced how often injection flaws make it to production, though it’s still dangerous when it does occur.
Q;4 What happened to Server-Side Request Forgery (SSRF)?
Answer It no longer has its own category. OWASP folded it into Broken Access Control (A01) since SSRF is fundamentally an access control problem at the server level.
Q:5 Can automated scanners cover the whole Top 10 by themselves?
Answer No. Scanners handle mechanical categories like injection and misconfiguration well, but access control, insecure design, and exception handling generally require manual testing and business-logic review.
