OWASP Top 10 2025: the list and what pentesters check for each item

The OWASP Top 10 is a ranked list of the most critical web application security risks. As of November 2026 the latest released edition is OWASP Top 10:2025. The OWASP project page says: "The most current released version is the OWASP Top 10 2025." It lists 2021 and 2017 as earlier editions. We checked this on 2026-11-09.

Below is the 2025 list with exact IDs, a one-line meaning and the first checks for each item. Treat the Top 10 as a coverage map for web application penetration testing. It gives no test steps.

What changed from the 2021 list?#

OWASP states three changes in its 2025 introduction. Two categories are new: A03 Software Supply Chain Failures and A10 Mishandling of Exceptional Conditions. SSRF, which was A10:2021, is now part of A01. A02 Security Misconfiguration moved up from fifth to second place. Cryptographic Failures fell from second to fourth, and Injection fell from third to fifth.

The release date of the 2025 edition is not on the OWASP pages we read, so we do not state one.

The OWASP Top 10:2025 list#

The OWASP web page writes "and" in place of "&" in A09. The names above follow the project's own source Markdown.

What do testers check for each category?#

Each entry has a one-line meaning and the checks to run first. The checks are our testing priorities, not OWASP's wording.

A01:2025 Broken Access Control#

Users can act outside their intended permissions. The 2025 introduction reports A01 in 3.73% of tested applications on average. Testers check:

• Object access. Replace IDs in URLs, bodies and headers with IDs from a second account. See IDOR testing.
• Function access. Call admin or owner endpoints with a low-role token.
• Server-side fetches. Test any feature that loads a URL the user supplies (the SSRF cases now inside A01).

A02:2025 Security Misconfiguration#

Settings, defaults or cloud permissions leave the system more open than intended. Testers check:

• Debug pages, stack traces and default credentials.
• Missing or weak security headers and permissive CORS rules.
• Public storage buckets, open admin panels and verbose error output.

A03:2025 Software Supply Chain Failures#

Code, packages, build steps or update channels bring in untrusted or vulnerable components. Testers check:

• Client-side bundles and dependency manifests for known-vulnerable libraries.
• Third-party scripts loaded without integrity checks.
• Exposed CI files, source maps and package registry tokens.

A04:2025 Cryptographic Failures#

Sensitive data is not protected in transit or at rest, or the cryptography is weak or misused. Testers check:

• TLS configuration and cleartext fallbacks.
• Password storage, token formats and signing key handling that the app exposes.
• Secrets in responses, URLs and client code.

A05:2025 Injection#

Untrusted input reaches an interpreter such as SQL, a shell, a template engine or the browser (cross-site scripting). Testers check:

• Every input that reaches a query, command or template, with safe payloads and controls.
• Reflected and stored output in a real browser.
• Second-order paths, where saved input is used later.

A06:2025 Insecure Design#

The design lacks a needed control, so no code fix alone removes the risk. Testers check:

• Workflow rules, limits and approval steps. See business logic vulnerabilities.
• Missing abuse limits on sensitive actions.
• Trust placed in client-side values such as prices and roles.

A07:2025 Authentication Failures#

Login, session or recovery logic lets someone act as another user. Testers check:

• Password reset, MFA and session handling. Use the authentication testing checklist.
• Account enumeration and weak lockout rules.
• Session cookies after logout and after a password change.

A08:2025 Software or Data Integrity Failures#

The app trusts code or data without checking where it came from. Testers check:

• Unsigned or unchecked update and plugin channels.
• Deserialization of data that the client controls.
• Tampering with signed values such as cookies and webhooks.

A09:2025 Security Logging & Alerting Failures#

Security events are not logged, or nobody sees the alerts. Testers check:

• Whether failed logins, access denials and admin actions create log entries, when the customer gives log access.
• Whether log entries carry secrets or full tokens.
• Whether alert paths fire during bounded test activity.

A10:2025 Mishandling of Exceptional Conditions#

The app fails open or leaks data when something unexpected happens. Testers check:

• Malformed, oversized and missing input on each endpoint.
• Whether errors skip an authorization or validation step.
• Whether error messages expose internals.

How do you use the list in a real test?#

Use the Top 10 to check that no category is skipped, then spend time where the risk is. A01, A06 and A07 need the most manual work: they need two accounts and knowledge of the app's rules, and a scanner reports only what it sees in a single session.

How does a tester prove a finding?#

A finding needs evidence of a real effect. For an access control issue, that means two test accounts, a request from the wrong account, and a read-back that shows the data or the change. A bare "200 OK" proves nothing. We also run controls (a nonexistent ID, the right account, an anonymous caller) and report the controls that held.

How do teams fix these issues?#

Fix the cause of each issue. Add an authorization check in one shared place. Remove debug settings from production builds. Pin and review dependencies. Make errors deny access by default. Then ask for a retest, so the same evidence checks the fix.

For API-specific risks, read the OWASP API Security Top 10 guide.

How does the 2025 list map to the 2021 list?#

Many customer questionnaires still cite the 2021 list. The table maps each 2021 item to its 2025 home, based on the changes OWASP states in its introduction. We checked the 2021 list on 2026-11-09.

If a buyer asks for "OWASP Top 10 coverage", state the edition in the scope. The checks overlap, so one test plan can cover both lists.

What does the Top 10 not tell you?#

The Top 10 ranks risk categories. It does not say which of your features carry the risk, how to test them, or what counts as a pass.

• Ten categories hide hundreds of weakness types. A01 alone groups 40 CWEs, according to the 2025 introduction.
• Your own risk order may differ. A banking app and a blog differ on A06 and A09.
• For test steps, use the OWASP Web Security Testing Guide. For a requirements list, use OWASP ASVS.
• A Top 10 label on a finding says nothing about test quality. Ask the tester for evidence on each finding and for the list of controls that held.

In a pentest report, the Top 10 mapping should appear as a label on each finding.