OWASP Top 10 Security Risks

Broken Access Control

Failures in access control enforcement that let users act outside their intended permissions. This includes bypassing access check...

A02

Security Misconfiguration

Missing or incorrect security hardening across the application stack: default accounts/passwords, unnecessary features enabled, ov...

A03

Software Supply Chain Failures

NEW in 2025. Expands the previous "Vulnerable and Outdated Components" to cover the entire software supply chain ecosystem: compro...

A04

Cryptographic Failures

Failures related to cryptography that lead to exposure of sensitive data or system compromise. This includes transmitting data in ...

A05

Injection

Application vulnerable to injection when user-supplied data is not validated, filtered, or sanitized. Includes SQL injection, NoSQ...

A06

Insecure Design

Risks from missing or ineffective security controls at the design level. Unlike implementation bugs, insecure design cannot be fix...

A07

Identification and Authentication Failures

Failures in authentication mechanisms: credential stuffing, brute force, weak passwords, session fixation, improper session invali...

A08

Software and Data Integrity Failures

Code and infrastructure that does not protect against integrity violations. This includes software updates without integrity verif...

A09

Security Logging and Monitoring Failures

Insufficient logging, detection, monitoring, and active response. Without these, breaches cannot be detected in a timely manner. M...

A10

Mishandling of Exceptional Conditions

NEW in 2025. Emphasizes the importance of secure error handling and resilience. Weak or missing error handling can expose critical...

API Security Risks (2023)

API1

Broken Object Level Authorization

APIs exposing endpoints that handle object identifiers without verifying the requesting user has permission to access the specific...

API2

Broken Authentication

Authentication mechanisms in APIs are often implemented incorrectly, allowing attackers to compromise authentication tokens or exp...

API3

Broken Object Property Level Authorization

APIs that expose or allow modification of object properties that should be restricted. Combines mass assignment and excessive data...

API4

Unrestricted Resource Consumption

APIs that don't limit the number of requests, payload sizes, or resources consumed per client. Missing rate limiting, no paginatio...

API5

Broken Function Level Authorization

APIs with complex access control policies where administrative or privileged functions are accessible to regular users. Often invo...

API6

Unrestricted Access to Sensitive Business Flows

APIs that expose sensitive business flows (purchasing, commenting, voting, booking) without protecting against excessive automated...

API7

Server Side Request Forgery

SSRF in the context of APIs — webhook URLs, file import from URL, custom integrations, and URL preview features that fetch user-pr...

API8

Security Misconfiguration

Misconfigured API security settings: missing security headers, unnecessary HTTP methods enabled, permissive CORS, verbose error me...

API9

Improper Inventory Management

Organizations losing track of their API inventory: deprecated API versions still active, unpatched endpoints, debug endpoints expo...

API10

Unsafe Consumption of APIs

Developers trusting data received from third-party APIs without validation. When integrating external APIs, developers often apply...