The OWASP Top 10 is the most widely used list of critical web application security risks, and the reference point for most security questionnaires, penetration-test reports and compliance checklists. The 2025 edition is the first update since 2021. It reflects two shifts: attackers going after configuration and dependencies rather than code alone, and applications that fail in unsafe ways when something unexpected happens.
The OWASP Top 10:2025 list
| # | 2025 category | Change from 2021 |
|---|---|---|
| A01 | Broken Access Control | Still #1, now also covers Server-Side Request Forgery (SSRF) |
| A02 | Security Misconfiguration | Up from #5 |
| A03 | Software Supply Chain Failures | New: expands "Vulnerable and Outdated Components" |
| A04 | Cryptographic Failures | Down from #2 |
| A05 | Injection | Down from #3 (includes XSS) |
| A06 | Insecure Design | Down from #4 |
| A07 | Authentication Failures | Renamed from "Identification and Authentication Failures" |
| A08 | Software or Data Integrity Failures | Same position |
| A09 | Security Logging and Alerting Failures | Renamed to stress alerting, not just logging |
| A10 | Mishandling of Exceptional Conditions | New category |
Always check the official list at owasp.org for the final wording and the mapped CWEs. This article focuses on what the changes mean in practice.
What actually changed, and why it matters
Security Misconfiguration moved to #2
Modern apps are mostly configuration: cloud storage permissions, CDN rules, CORS, response headers, debug flags, default admin panels. One wrong setting exposes more than one bad line of code. This is also the cheapest category to fix. Missing HSTS, an absent Content-Security-Policy, permissive CORS and verbose error pages all show up in a five-minute scan. Run your production domain through the free ZetsApp Website Security Audit to see your browser-facing configuration graded in seconds.
Software Supply Chain Failures is a new #3
The 2021 list warned about outdated components. 2025 widens that to the whole chain: package registries, build pipelines, CI secrets, CDN-hosted scripts and the AI coding assistants that suggest dependencies. Practical controls:
- Lock files committed and enforced (
npm ci, notnpm install, in CI). - Automated dependency alerts (Dependabot, Renovate,
npm audit,dotnet list package --vulnerable). - Subresource Integrity hashes on every versioned CDN script.
- A software bill of materials (SBOM) generated at build time.
- Verifying that packages an AI assistant suggests actually exist and are the real ones. "Slopsquatting" attackers register package names that models commonly hallucinate.
SSRF folded into Broken Access Control
Server-side request forgery, where an attacker makes your server fetch an internal URL such as a cloud metadata endpoint, is now treated as an access-control failure. That is the right framing: the server is acting on a resource the user should never reach. If your app fetches user-supplied URLs (link previews, webhooks, importers, "scan my site" tools), resolve the host yourself and refuse private, loopback, link-local and metadata IP ranges at connect time, not only when you parse the URL. Otherwise DNS rebinding gets around the check.
Mishandling of Exceptional Conditions is new at #10
This category covers apps that do not prevent, detect or respond correctly to unusual situations: unhandled exceptions that leak stack traces, logic that fails open (a permission check that returns "allowed" when the policy service times out), partial transactions left half-applied, and resource exhaustion. The fix is mostly discipline: fail closed, use global exception handlers that return generic messages, wrap multi-step writes in transactions, and set timeouts and size limits on every external call.
A fix-first plan for small and mid-size teams
- This week, configuration (A02): security headers, TLS, cookie flags, CORS allow-list, disable directory listing and debug output. Mostly one-line changes.
- This month, access control (A01): make sure every API endpoint checks that this user may act on this record (no IDOR), deny by default, and add tests for it.
- This month, supply chain (A03): turn on dependency alerts, pin and hash CDN scripts, and lock down CI secrets.
- This quarter, alerting and exceptions (A09, A10): alert on repeated auth failures and 5xx spikes, and review the code paths that fail open.
How OWASP maps to compliance
ISO 27001 auditors, SOC 2 assessors and PCI DSS 4.0 (requirement 6) all expect you to address the OWASP Top 10 or an equivalent. Showing a recent scan, a dependency policy and an access-control test suite covers most of the evidence they ask for.
ZetsApp builds secure-by-default web apps and hardens existing ones as part of our custom software development and DevOps services. If you are building with AI coding tools, read our vibe-coding security checklist too.
Frequently asked questions
What is new in the OWASP Top 10 2025?
Two new categories (A03 Software Supply Chain Failures and A10 Mishandling of Exceptional Conditions), Security Misconfiguration rising to #2, SSRF merged into A01 Broken Access Control, and A09 renamed to Security Logging and Alerting Failures.
What is the number one OWASP risk in 2025?
Broken Access Control: users being able to view or change data or functions they should not, now including server-side request forgery.
Is XSS still in the OWASP Top 10?
Yes. Cross-site scripting is part of A05 Injection. A strict Content-Security-Policy and framework output encoding are the main defences.
How do I test my website against the OWASP Top 10?
Combine an automated configuration scan (such as the ZetsApp Website Security Audit) for misconfiguration and supply-chain signals with dependency scanning in CI and a manual penetration test for access control and business logic.
