A10: Mishandling of Exceptional Conditions
A10:2025 Mishandling of Exceptional Conditions is the other new category. It covers improper error handling, logical errors and failing open — what systems do when something abnormal happens. It absorbs weaknesses previously filed under general poor code quality, which the project judged too vague to be useful.
Why it is like this
How a system behaves when it breaks is a security property, and it had no home on the list. "Poor code quality" was a bucket nobody could act on; naming the failure mode makes it testable.
Not to be confused with
A code-quality category. Its CWEs are specific and security-relevant: error messages that leak information, missing parameters, improper handling of insufficient privileges, null dereference, and not failing securely.
In practice
The one to internalise is failing open: an authorisation check that throws, is caught, and returns allow. The happy path is tested; that branch rarely is.
Source: OWASP Top 10:2025 — A10:2025 Mishandling of Exceptional Conditions. Read on .
The OWASP Top 10:2025 is © 2021-2025 the OWASP Top 10 Team and is licensed under a Creative Commons Attribution 3.0 Unported Licence. These cards are independent commentary written in our own words. ytyk.org is not affiliated with or endorsed by the OWASP Foundation.
Odd one out Check yourself
Three of these sit in A10:2025. Which one does not?
Show the answer
A dependency with a published CVE
That is A03. A10 is about how the system behaves under abnormal conditions, not about what it is built from.