OWASP Top 10:2025 · pillar 3 of 6
Access, configuration and identity
The top two, and the one that has not moved in four years.
- 7 A01: still number one, and found everywhere Broken Access Control holds #1. 100% of applications tested showed some form of it, and it has the highest number of…
- 8 A02: up from fifth, because behaviour moved into config Security Misconfiguration rose from #5 in 2021 to #2 in 2025. 100% of applications tested showed some form of it, with…
- 9 A07: unmoved at seventh, and renamed Authentication Failures keeps #7, renamed from Identification and Authentication Failures to better fit its 36 CWEs…
Start this pillar See the whole map
Read against OWASP Top 10:2025 on . Regulations and frameworks change; the date is there so you can tell whether this has kept up.
The OWASP Top 10:2025 is © 2021-2025 the OWASP Top 10 Team and is licensed under a Creative Commons Attribution 3.0 Unported Licence. These cards are independent commentary written in our own words. ytyk.org is not affiliated with or endorsed by the OWASP Foundation.