OWASP Top 10:2025: What Changed and What to Test

The OWASP Top 10 is a consensus list of the most critical web application security risks, built from vulnerability data that organizations contribute plus a community survey. It is an awareness document, not a standard you pass or fail. OWASP's own project page names the 2025 edition as the most current release, and the 2021 list is now an earlier edition.

If a customer, auditor or tender asks for testing against the OWASP Top 10, ask which edition they mean. A report that maps findings to the 2021 categories is still useful, but a new engagement should map to 2025.

1. A01 Broken Access Control. Still first on the list.
2. A02 Security Misconfiguration.
3. A03 Software Supply Chain Failures. New in this form.
4. A04 Cryptographic Failures.
5. A05 Injection. Down from third place.
6. A06 Insecure Design.
7. A07 Authentication Failures. Renamed from "Identification and Authentication Failures".
8. A08 Software or Data Integrity Failures.
9. A09 Security Logging and Alerting Failures. Renamed from "Logging and Monitoring".
10. A10 Mishandling of Exceptional Conditions. New.

Server-side request forgery is now part of access control

SSRF had its own slot in 2021. In 2025 it is rolled into A01, which fits how it behaves in practice: the server is tricked into making a request the user was never allowed to make, often to internal services or cloud metadata. For a tester it means SSRF checks belong in the same pass as authorization checks, and for a developer it means egress rules and allow-lists are an access control job.

Supply chain failures widen "outdated components"

A03 grows the old "Vulnerable and Outdated Components" idea to cover dependencies, build systems and distribution infrastructure. OWASP notes that this category has the fewest occurrences in the contributed data, yet the highest average exploit and impact scores, and says it expects testing to catch up. In plain terms: a compromised package or build pipeline is rare in test data because it is hard to test, not because it is rare in the real world.

Mishandling of exceptional conditions is new

A10 covers improper error handling, logic errors and systems that fail open when something unexpected happens. A payment check that is skipped when the fraud service times out is an example. These bugs hide in code that only runs when things go wrong, so scanners rarely find them and manual testing has to provoke them.

Injection falls, but does not go away

Injection drops from third to fifth. Frameworks and scanners now catch much of it, which is why the ranking fell, not because attackers lost interest. Cross-site scripting sits in this category with SQL injection, one frequent and low impact, the other less frequent and high impact.

Alerting, not just logging

A09 now says "alerting" because logs nobody reads do not stop an incident. A good test asks whether a burst of failed logins or a run of access-denied errors would reach a person.

• Supply chain. Review the dependency list and lockfiles, check that builds are reproducible and pinned, check who can publish to your package registry and who can change the pipeline, and look for secrets in build logs.
• Exceptional conditions. Send malformed input, drop connections midway, make dependencies fail and watch what the application decides to do. Check that errors do not reveal stack traces, queries or internal addresses, and that the default answer to a failed check is "deny".
• Access control with SSRF. Test every feature that fetches a URL, imports a file from a link, renders a preview or calls a webhook, and test the server's access to internal ranges and metadata addresses.

The list is deliberately short. Business logic flaws such as skipping a payment step, abusing a coupon or racing two requests are mostly invisible to it. APIs have their own list, the OWASP API Security Top 10 from 2023, which remains the current edition. A good web application test uses the Top 10 as a minimum and then spends most of its time on how your particular application works.

If your last test was mapped to the 2021 list, your reports and your scope may be a release behind. Our web application penetration testing follows the current OWASP edition and goes further, with engineers testing the logic of your application by hand. For a customer-facing API, add API security testing. To scope a test, request a scoping call, or read our methodology first.

Facts in this article were checked on 4 November 2026 against these primary sources:

• OWASP Top 10:2025, introduction
• OWASP Top 10 project page
• OWASP API Security project