The Open Worldwide Application Security Project (OWASP) has updated its Top 10 list of web application risks for the first time since 2021, and has essentially created a “rebooted” version with a number of categories introduced or merged to better reflect the modern threat landscape. The one thing that hasn’t changed about the OWASP Top 10 is that “broken access control” is still the lead category after all this time, present as a security risk in 3.73% of the apps that were tested.
OWASP Top 10 sees some category movement, but access control remains most frequent issue
The OWASP Top 10 list is based on application data donated to the project by over a dozen cybersecurity firms and other anonymous sources, creating a pool of data for over 2.8 million apps for this most recent edition. The project has had sporadic releases of these reports, generally once every three to four years, since 2003. The long time lapses and unpredictable release schedule is due primarily to the continual development of testing methods that can analyze particular vulnerabilities at scale; this is necessarily a backwards-looking process, with some trends only captured several years after the fact, so the project also circulates a community survey among security professionals that asks for personal observations and synthesizes them into the rankings to get a more current picture of the threat landscape.
One category has reliably been on top of the OWASP Top 10 for many years now, however: “Broken Access Control.” The report finds 3.73% of the applications tested had one or more of the 40 Common Weakness Enumerations (CWEs) in this category. These include various means of bypassing access control checks, failure to implement “deny by default” design, or the ability to “force guess” unique identifier numbers as a few examples. This heading also saw a category present in previous reports, “Server-Side Request Forgery (SSRF),” merged into it; the SSRF category was in the #10 position on the list in 2021.
Most of the rest of the movement in the OWASP Top 10 2025 is in the #2 to #5 spots, with some prior categories seeing changes and mergers. The #2 spot now belongs to security misconfigurations, which was present in 2021 and jumped up from the #5 position. 3% of the tested applications had one or more of the 16 CWEs used by the researchers (such as unnecessary and vulnerable features or default credentials left enabled). The researchers find that this is primarily due to software engineering in general more commonly basing app behavior on configurations.
The #3 category for the OWASP Top 10, software supply chain failures, is a revision of the former “vulnerable and outdated components” category. It has been expanded to include a broader scope of failures across software dependencies, build systems, and distribution infrastructure. The report notes that this is one of the categories where testing needs the most improvement, as observed occurrences are relatively few but the ones that appear have the highest average exploit and impact scores from CVEs. This category is also consistently listed as one of the leading concerns by the community survey.
Cryptographic failures, injection and insecure design are the three other categories that moved for the OWASP Top 10 2025, all shifting down together from #s 2-4 in 2021 to #4-6 in the latest report. These categories did not see any big changes or mergers, and the researchers attribute the drop in part to general improvements in secure-by-design approaches and threat modeling.
The final four spots are almost identical to the 2021 edition. At positions 7-9 are authentication failures, software and data integrity failures, and logging and alert failures. With the former #10 category being merged out of existence, the spot now goes to the “mishandling of exceptional conditions” category. This category is a new introduction for OWASP Top 10 2025 and consists of 24 CWEs involving abnormal conditions such as improper error handling or failure to open.
OWASP Top 10 sees some differences between local network and cloud security
The researchers note that the OWASP Top 10 continues to focus more on traditional software security rather than issues specific to cloud-based hosting. If the list were to focus on cloud and infrastructure security primarily, security misconfigurations (such as errant public-facing databases) would readily vault into the #1 spot.
On a similar note, OWASP maintains a separate list of the top 10 risks posed by LLMs and generative AI. Prompt injection tops that list, followed by sensitive information disclosure and weaknesses in the supply chain.
Patterns become apparent as one looks over the OWASP Top 10 lists dating back as far as 20 years, with the top risk categories tending to stay at or close to the same positions. However, the list also highlights definite improvements in certain areas (such as secure-by-design and threat modeling).
The researchers note that this work is far too broad to ever be truly complete and up-to-date, and there are potential blind spots as Tim Mackey (Head of Software Supply Chain Risk Strategy at Black Duck) notes: “The inclusion of a broader view of software supply chain risk as A03:2025 is an encouraging step towards moving the needle on 3rd party risk. Unfortunately, OWASP didn’t take advantage of the obvious opportunity to highlight how open-source software differs from its commercial counterparts. While concepts of “obsolete”, “unsupported”, and “end of life” represent key phases in the life cycle of any commercial software, they don’t apply the same way to open-source. For example, an open-source library that’s critical to an application and which is “unsupported”, could easily become “supported” by the application owners simply forking that library and bringing support in-house.”
