A07: unmoved at seventh, and renamed
Authentication Failures keeps #7, renamed from *Identification and Authentication Failures* to better fit its 36 CWEs. The project notes that increased use of standardised frameworks appears to be reducing occurrences.
Why it is like this
This is the clearest evidence on the list that the industry can fix a category: authentication was solved generically, delegated to identity providers and libraries, and stopped climbing.
Not to be confused with
Solved. Its CWEs are still ordinary and still shipped — hard-coded passwords and credentials, improper certificate validation against the host, session fixation.
In practice
The contrast with A01 is the lesson: what can be delegated to a framework gets better, what encodes your own domain rules does not.
Source: OWASP Top 10:2025 — A07:2025 Authentication Failures. Read on .
The OWASP Top 10:2025 is © 2021-2025 the OWASP Top 10 Team and is licensed under a Creative Commons Attribution 3.0 Unported Licence. These cards are independent commentary written in our own words. ytyk.org is not affiliated with or endorsed by the OWASP Foundation.
Odd one out Check yourself
Three of these are A07 weaknesses. Which belongs to a different category?
Show the answer
A user reaching another user's record by changing an identifier
That is A01. A07 is about establishing who someone is; A01 is about what they may then reach.