Four names changed, and SSRF moved house
Three categories were renamed and one was merged. *Identification and Authentication Failures* is now Authentication Failures; *Software and Data Integrity Failures* is now *Software or Data Integrity Failures*; *Security Logging and Monitoring Failures* is now *Security Logging and Alerting Failures*. And SSRF, a standalone entry in 2021, was rolled into A01.
Why it is like this
Each rename narrows or sharpens the claim. Monitoring became alerting because great logging that alerts nobody has minimal value; "and" became "or" because either failure is enough.
Not to be confused with
Cosmetic. If you maintain a mapping — a scanner profile, a policy, a training deck — SSRF silently changing parents will break it quietly rather than loudly.
In practice
A 2021-based control matrix that still has a row for SSRF and a column for "Monitoring" is now mismapped in two places at once.
Source: OWASP Top 10:2025 — Introduction, What's changed. Read on .
The OWASP Top 10:2025 is © 2021-2025 the OWASP Top 10 Team and is licensed under a Creative Commons Attribution 3.0 Unported Licence. These cards are independent commentary written in our own words. ytyk.org is not affiliated with or endorsed by the OWASP Foundation.
Predict Check yourself
Where did Server-Side Request Forgery go in the 2025 list?
Show the answer
Rolled into A01:2025 Broken Access Control.
SSRF is a failure to control which resources a request may reach, so access control is where it belongs — but anyone looking for its old slot will not find it.