GuardX
Get started

Protection

8 min readUpdated

OWASP Top 10 2025: the full list, what changed and what a WAF covers

Quick answer

The OWASP Top 10:2025 is the eighth edition of OWASP's awareness list of the most critical web application security risks. In order: broken access control, security misconfiguration, software supply chain failures, cryptographic failures, injection, insecure design, authentication failures, software or data integrity failures, security logging and alerting failures, and mishandling of exceptional conditions. It replaced the 2021 list, added two categories and folded SSRF into access control.

01What is on the OWASP Top 10 2025 list?

The OWASP Top 10 is an awareness document: the Open Worldwide Application Security Project's ranking of the ten most critical risk categories in web applications, published since 2003 and now in its eighth edition. Each entry groups weaknesses from MITRE's CWE list rather than naming one bug: OWASP analysed 589 CWEs and mapped 248 into the ten categories.

The ranking is data-informed rather than purely data-driven. Contributors supplied test results for more than 2.8 million applications; OWASP took eight categories from that data and two from a community survey of practitioners, to capture risks that automated testing does not yet find.

RankCategoryWhat it meansTypical example
A01Broken Access ControlUsers can act outside their permissions; includes CSRF and, since 2025, SSRFChanging an account number in the URL shows another customer's account
A02Security MisconfigurationInsecure defaults, needless features, verbose errorsA sample admin console left in production with its default password
A03Software Supply Chain FailuresCompromised or vulnerable dependencies, build systems and distributionA malicious release of a trusted library, as in the XZ Utils backdoor
A04Cryptographic FailuresMissing, weak or misused cryptographyUnsalted password hashes exposed through a file upload flaw
A05InjectionUntrusted input executed by an interpreter, including SQL, OS commands and cross-site scriptingAn id parameter that turns a database query into 'return every row'
A06Insecure DesignA control that was never designed, including business-logic flawsA group-booking flow that lets a few requests reserve 600 seats without a deposit
A07Authentication FailuresWeaknesses that let attackers pass as someone elseCredential stuffing with leaked passwords against a login without MFA
A08Software or Data Integrity FailuresCode or data trusted without verifying itUnsafe deserialisation, as in React2Shell
A09Security Logging and Alerting FailuresAttacks go unlogged, or are logged without anyone being alertedA breach of health records that may have run for more than seven years
A10Mishandling of Exceptional ConditionsErrors that leave the system failing open or in an unknown stateA multi-step transfer that is not rolled back when one step fails

02What changed from the OWASP Top 10 2021?

OWASP sums up the update as two new categories and one consolidation: server-side request forgery joined broken access control, vulnerable components grew into software supply chain failures, and mishandling of exceptional conditions is new. Misconfiguration rose from fifth to second, and three categories were renamed.

20212025Change
A01 Broken Access ControlA01 Broken Access ControlStill first; absorbs SSRF
A02 Cryptographic FailuresA04 Cryptographic FailuresDown two places
A03 InjectionA05 InjectionDown two places; still includes cross-site scripting
A04 Insecure DesignA06 Insecure DesignDown two places
A05 Security MisconfigurationA02 Security MisconfigurationUp three places
A06 Vulnerable and Outdated ComponentsA03 Software Supply Chain FailuresBroadened to builds, pipelines and distribution; ranked first by half of survey respondents
A07 Identification and Authentication FailuresA07 Authentication FailuresRenamed
A08 Software and Data Integrity FailuresA08 Software or Data Integrity FailuresRenamed
A09 Security Logging and Monitoring FailuresA09 Security Logging and Alerting FailuresRenamed to stress alerting
A10 Server-Side Request Forgery (SSRF)Merged into A01No longer a separate category
Not listedA10 Mishandling of Exceptional ConditionsNew: 24 CWEs on error handling and failing open

03Which OWASP Top 10 risks can a WAF stop?

A web application firewall at the edge sees each HTTP request before the application does, so it is strong where an attack shows in the request itself and weak where the flaw lives in logic, stored data or the build. The verdicts below assume a well-tuned edge WAF in front of an origin that cannot be reached directly.

CategoryEdge WAFWhat the edge can doThe fix at the origin
A01 Broken Access ControlPartialBlock path traversal and requests for .git or backup files; strip internal headers from outside traffic, as for the Next.js middleware bypassDeny by default and check ownership of every record on the server; test authorisation
A02 Security MisconfigurationPartialAdd security headers, hide error pages, block known admin and debug pathsA repeatable hardening process; remove samples and default accounts
A03 Software Supply Chain FailuresLimitedVirtual-patch a published exploit pattern, as for Log4Shell, while the upgrade is rolled outAn SBOM, dependency monitoring, signed artefacts and staged rollouts
A04 Cryptographic FailuresLimitedEnforce current TLS and HSTS on the public sideStrong password hashing, encryption at rest, key management
A05 InjectionStrong, not completeBlock common SQL injection, command injection and script payloadsParameterised queries, context-aware output encoding, no shell calls built from input
A06 Insecure DesignNoneAt most, rate-limit abuse of a flawed flowThreat modelling, and business limits enforced in code
A07 Authentication FailuresPartialRate limits and bot challenges slow credential stuffing and password sprayingMFA, breached-password checks, sessions invalidated at logout
A08 Software or Data Integrity FailuresLimitedBlock known deserialisation exploit payloadsNever deserialise untrusted data; sign updates; subresource integrity for third-party scripts
A09 Security Logging and Alerting FailuresSupportingLog and alert on blocked attacks centrallyLog logins, failures and high-value actions, and alert on them
A10 Mishandling of Exceptional ConditionsPartialReject malformed and oversized requestsFail closed, handle errors where they occur, roll back partial transactions

04What an edge WAF can and cannot do

The pattern in the table is consistent: an edge WAF buys time and removes noise, while the lasting fix for every category, injection included, is in code, configuration or process. A web application firewall is worth having for what it does well, as long as nobody mistakes it for the fix.

  • Can: inspect every request before it reaches the application, and apply a virtual patch within hours of a disclosure
  • Can: reject malformed HTTP, rate-limit and challenge automated abuse, and log attacks centrally
  • Cannot: see who owns a record, what a business rule should allow, or which libraries an application runs
  • Cannot: fix code that fails open, stores passwords badly or deserialises untrusted data
  • Cannot: protect an origin that attackers reach directly, so hide the origin address and accept traffic only from the proxy

05What risks sit just outside the top ten?

OWASP's Next Steps chapter for 2025 names three risks that did not make the list but deserve attention: X01 Lack of Application Resilience, X02 Memory Management Failures and X03 Inappropriate Trust in AI Generated Code, often called vibe coding.

X01 covers applications that cannot withstand stress, failures and edge cases, which OWASP says most commonly ends in availability problems: the home of denial of service, from HTTP floods to protocol abuse such as HTTP/2 Rapid Reset. X02 matters for software written in C and C++, such as web servers; OWASP notes it has the third most related CVEs, and heap overflows like NGINX Rift are the kind of flaw it describes.

06How should teams use the OWASP Top 10?

As a map of where to look, not a checklist to sign off. OWASP's own comparison recommends the Top 10 for awareness and entry-level training, and ASVS for architecture, coding standards, code review and every kind of testing.

  • Map each category to the parts of the application it touches, starting with access control, configuration and dependencies
  • Put dependency scanning and an SBOM into the build for A03, and subscribe to advisories for every component in use
  • Include functional access-control checks in unit and integration tests, as OWASP recommends for A01
  • Put an edge WAF in front for injection probes, automated login attacks and virtual patches, and log what it blocks
  • Alert on failed logins, access-control failures and blocked attacks, so A09 is covered by people as well as logs

07OWASP Top 10 timeline

DateEvent
2003The first OWASP Top 10 is published
2013Using Components with Known Vulnerabilities first appears, as A9; it is the ancestor of today's supply chain category
2017The edition draws on about 30 CWEs
2021The edition draws on almost 400 CWEs; Insecure Design is introduced
6 November 2025The 2025 edition is presented as a release candidate at OWASP Global AppSec
24 December 2025The release-candidate notice is removed and the 2025 edition becomes the site's default
October 2026The 2025 edition is current; this page was checked against it

Questions

Frequently asked questions

It is the eighth edition of OWASP's list of the ten most critical web application security risk categories, built from test data on more than 2.8 million applications and a survey of practitioners. Each entry groups related weaknesses from MITRE's CWE list. The 2025 edition replaced the 2021 list and is the current version.

Broken access control, as in 2021. OWASP reports that every application tested had some form of it, and the category now includes server-side request forgery. It covers any way users can act outside their permissions, such as reading another customer's records by changing an identifier in a request, or reaching admin functions without the right role.

Two categories are new: Software Supply Chain Failures, which broadens the old vulnerable components entry to builds, pipelines and distribution, and Mishandling of Exceptional Conditions, which covers error handling and systems that fail open. Server-side request forgery was merged into broken access control, and security misconfiguration rose from fifth to second place.

No. OWASP calls it primarily an awareness document and says that, used as a coding or testing standard, it is the bare minimum and only a starting point. Some categories, such as insecure design, are beyond most forms of testing. For verifiable requirements OWASP recommends its Application Security Verification Standard instead.

Partly. An edge WAF is strong against common injection payloads and useful against automated login attacks, known exploits and malformed requests. It cannot see authorisation rules, business logic, how passwords are stored or which dependencies an application runs, so most categories still need fixes in code and process. OWASP itself discourages any claim of full coverage.

Recent editions arrived every four years: 2013, 2017, 2021 and 2025. Between editions OWASP collects new test data and runs a community survey. The 2025 edition was presented as a release candidate in November 2025 and became the default version on the project site in December 2025.

Sources

Sources and verification

  1. 01OWASP Top 10:2025 Introduction · OWASP
  2. 02OWASP Top 10:2021 · OWASP
  3. 03A01:2025 Broken Access Control · OWASP
  4. 04A03:2025 Software Supply Chain Failures · OWASP
  5. 05A10:2025 Mishandling of Exceptional Conditions · OWASP
  6. 06Establishing a Modern Application Security Program (using the Top 10 as a standard) · OWASP
  7. 07Next Steps: X01 to X03 · OWASP
  8. 08The New 2025 OWASP Top 10 List: What Changed, and What You Need to Know · Fastly
  9. 09OWASP/Top10 commit: Remove RC notice (24 December 2025) · GitHub
  10. 10OWASP/Top10 commit: Update root redirect to point to 2025 version (24 December 2025) · GitHub

Last updated