OWASP Top 10 2025: What Changed and Why It Matters for Your AppSec Program

The OWASP Top 10:2025 is the eighth edition of OWASP's list of the most critical web application security risks. OWASP sums up the update as "two new categories and one consolidation", and several categories also moved up or down. If your security program is still calibrated to the 2021 list, here's what changed and what to do about it.

The 2025 List at a Glance

Source: OWASP Top 10:2025, checked on October 9, 2026.

The Biggest Shifts

1. Security Misconfiguration Moves Up to #2

OWASP moved Security Misconfiguration from #5 in 2021 to #2 in 2025. In practice, misconfiguration covers issues such as:

• Cloud storage bucket permissions (S3 public read, Azure Blob)
• Default credentials on cloud-provisioned services
• Unnecessary HTTP methods enabled
• Missing security headers (CSP, HSTS, X-Frame-Options)

Operational implication: if your scanning covers injection but doesn't systematically check HTTP headers, default credentials and exposed configuration, you're missing the category OWASP now ranks #2.

2. Software Supply Chain Failures Is New at A03

This category grows A06:2021 (Vulnerable and Outdated Components) from known-vulnerable libraries into compromises anywhere in the ecosystem of software dependencies. Among OWASP's recommendations: generate and manage a Software Bill of Materials (SBOM) centrally, for all of your software.

Operational implication: most of this category can't be tested from the outside. An external scanner can flag known-vulnerable versions that an internet-facing service exposes; the rest needs dependency scanning (SCA), an SBOM and controls on your build pipeline.

3. SSRF Is Now Part of Broken Access Control (A01)

Server-Side Request Forgery had its own category in 2021 (A10:2021). In 2025, OWASP rolled it into A01 Broken Access Control: only its place in the list changed. The canonical SSRF attack against cloud infrastructure still looks like this:

Attacker crafts request → Application fetches internal URL
→ AWS metadata endpoint (169.254.169.254)
→ Returns IAM credentials
→ Attacker has AWS access

Operational implication: test SSRF as part of your access-control testing. For blind SSRF, where the fetched content never comes back in the response, out-of-band callbacks are the reliable detection method.

4. Mishandling of Exceptional Conditions Is New at A10

This category is about software that meets an unexpected situation and doesn't handle it safely: improper error handling, logic errors and systems that "fail open". Typical examples are error messages that expose database details, uncaught exceptions that crash the application, or a multi-step transaction left half-done after an interruption.

Operational implication: review error handling. Fail closed, catch errors where they happen, keep stack traces and database errors out of responses, and roll back partially completed transactions.

What Did NOT Change (and Why That Matters)

Broken Access Control Remains #1

Broken Access Control kept the top spot. In the data behind the 2025 edition, OWASP found some form of broken access control in 100% of the applications tested (A01:2025).

If you have not invested in runtime authorization testing — testing that User A cannot access User B's resources — this should be your top security priority. Automated tools can assist but cannot replace testing against your application's specific authorization model.

Injection Moved Down, Not Away

Injection (SQL, XSS, command injection) dropped from #3 to #5. That does not mean injection is solved. Legacy codebases, hand-written SQL and NoSQL queries remain significant attack surfaces, and every application that builds queries from user input should be tested for injection regularly.

Cryptographic Failures (#2 to #4) and Insecure Design (#4 to #6) also dropped two places, as Security Misconfiguration and Software Supply Chain Failures moved ahead of them.

There Is Still No AI Category

The 2025 list has no AI or LLM category. OWASP covers those risks in a separate project, the OWASP Top 10 for LLM Applications.

What an External Scanner Can and Can't See

Several 2025 categories can't be tested from the outside. Insecure Design, Security Logging and Alerting Failures and most of Software Supply Chain Failures need threat modeling, code review or access to your build and logging systems. Mishandling of Exceptional Conditions is only partly visible, for example as verbose error pages.

An external scanner is strongest on misconfiguration, exposed components with known CVEs, and part of the injection, access-control and SSRF checks.

Updating Your Security Program

Checklist for aligning your program with the OWASP Top 10:2025:

• Re-map internal reports, tickets and policies from 2021 to 2025 category IDs
• Audit HTTP security headers, default credentials and exposed configuration (A02)
• Generate and maintain an SBOM, and monitor dependencies for new CVEs (A03)
• Test SSRF protections as part of access-control testing (A01)
• Test IDOR scenarios explicitly against your authorization model (A01)
• Review error handling: fail closed and keep stack traces out of responses (A10)
• Make sure security logs lead to alerts that someone acts on (A09)

The 2025 list is a recalibration, not a rewrite. The work is to extend coverage into misconfiguration, the software supply chain and error handling, while keeping access-control and injection testing in place.

PentestCheck labels findings with OWASP Top 10:2021 categories where a detection maps to one. It does not use the 2025 category IDs.