What is the OWASP Top 10?

The OWASP Top 10 is an awareness document from the Open Worldwide Application Security Project that ranks the ten most critical security risk categories for web applications. The current edition, 2025, starts with broken access control; each category groups many specific weaknesses and links to how to prevent them.

Why it matters

It is the shared vocabulary of web security. Developers, testers, auditors and customers' security questionnaires all refer to it, so knowing what each category means lets you read a report or a requirement without a translator. OWASP is explicit that it is an awareness document and a starting point, not a complete standard; for a testable checklist it points to the Application Security Verification Standard (ASVS).

The 2025 list in short: A01 broken access control, A02 security misconfiguration, A03 software supply chain failures, A04 cryptographic failures, A05 injection, A06 insecure design, A07 authentication failures, A08 software or data integrity failures, A09 security logging and alerting failures, A10 mishandling of exceptional conditions. Each category maps to CWE entries, so a finding like IDOR (CWE-639) lands in A01 and SQL injection (CWE-89) in A05.

Example: reading CyberGym through the Top 10

CyberGym runs OWASP Juice Shop, a deliberately vulnerable shop that OWASP maintains for practice, and a few harmless requests already touch several categories. Its response headers include no Content-Security-Policy and no Strict-Transport-Security, which falls under A02, security misconfiguration:

$ curl -sI https://cybergym.hackergpt.app/ | grep -i -E "content-security|strict-transport|x-frame|x-content-type"
X-Content-Type-Options: nosniff
X-Frame-Options: SAMEORIGIN
$ curl -s https://cybergym.hackergpt.app/rest/admin/application-version
{"version":"19.1.1"}

The admin route that answers an anonymous caller is A01, broken access control. Juice Shop's own challenge list is tagged by category, so you can pick one Top 10 entry and work through the challenges that belong to it.

On your own app, use the list as a set of questions rather than a scan: who can call each endpoint (A01), what the server reveals in headers and errors (A02), which dependencies you ship (A03), where input reaches a query or a page (A05). Each answer you cannot give is the next thing to test.

Common mistakes

  • Treating it as a compliance checklist. Being clear of ten categories does not make an app secure. Use ASVS for verifiable requirements.
  • Quoting an old edition. Categories move between editions; 2021's A03 injection is A05 in 2025. Cite the edition by year.
  • Ignoring the API list. APIs have their own OWASP API Security Top 10 (2023), with BOLA first.
  • Reading the rank as likelihood on your app. The order reflects data across many apps. Your own architecture decides your own risks.

Related terms

Go deeper

Sources

Test only sites you own or have written permission to test. To practise without one, use CyberGym, a legal, deliberately vulnerable target. Practise on CyberGym.