OWASP Top 10 2025 Explained for Business Web Apps: What Changed From 2021 and What to Fix First

The OWASP Top 10 2025 is focused on web applications and is structured to help organizations prioritize their efforts based on risk. Compared to previous editions, the 2025 edition expands the developer and security team risk categories, adds new categories, repositions risks, and puts more weight on root causes as compared to symptoms.

While the list itself is important, the business impact is in understanding what each category means for the application, which risks require consideration first, and if the development team has the processes in place to adequately address them, e.g. architecture, testing, and monitoring.

Xcentric Services has the technical skills and experience to review Website Development and Design, ecommerce sites, portals, and SaaS offerings, and determine how best to remediate any security flaws as part of a broader development engagement.

OWASP Top 10: 2025 at a Glance

The 2025 category list is published as the eighth Top 10 edition by OWASP, using CVE data, contributed app-security data and community feedback.

What Is the OWASP Top 10 Web Application Security List?

The OWASP Top 10 is a document that outlines the 10 most critical risks related to web application security. OWASP is the brainchild of several talented developers who wanted to improve application security. It has grown into a global community with offices in the US, UK, and Australia.

Though it was formally changed in 2023, the official expansion of OWASP (Open Worldwide Application Security Project) has always been this way. The popularity of the OWASP Top 10 lists has expanded beyond applications to encompass APIs and architectures.

The OWASP Top 10 lists are a starting point and an awareness tool. They should not be construed to mean that a web application is secure. The OWASP Top 10 lists are not security checklists. They should not be thought of as a security audit. Passing the OWASP Top 10 review does not guarantee the security of a web application. It is dangerous to equate the OWASP Top 10 list with a formal security process.

The OWASP Top 10 lists serve primarily as an awareness tool for application security. It helps the stakeholders of the organization understand what broken authorization, insecure dependencies, and other underlying security flaws in web and software applications are.

The grouping of risks changed in OWASP Top 10 2025. Around 589 CWEs were analyzed in the 2025 version, and OWASP focused more on root causes.

The OWASP Top 10 2025 covers authorization, configuration, software dependencies, cryptography, input handling, design, authentication, integrity, monitoring, and errors. The following elaborations provide business context for each of the OWASP Top 10 2025 categories and provide a practical first fix.

A01: 2025 Broken Access Control

Broken access control occurs when users can view or access information that they are not authorized to view or access. OWASP kept this risk at the top of the list in the OWASP Top 10 2025 and includes mapping to CSRF, path traversal, SSRF and exposure of sensitive information.

First fix: on the server side, ensure that for every sensitive business element and operation, an authorization check is performed. Do not rely on hidden buttons or front-end route guards or user-supplied IDs.

For applications built using React, this is the best place to implement proper CSRF controls. Xcentric has a related guide for implementing CSRF controls in React Applications.

A02: 2025 Security Misconfiguration

Security misconfiguration occurs when an application, cloud service, server, database, or security control is configured in a manner that creates an exposure. OWASP moved this category from number five in 2021 to number two in 2025.

An example would be running a production SaaS application with verbose debugging, permissive CORS, exposed administrative endpoints, insecure cookies, or excessive permission clouds.

First fix: Create and maintain a secure production configuration baseline and a comparison of development and staging baselines against it. Automate configuration checks and make production configurations as restrictive as possible.

A03: 2025 Software Supply Chain Failures

Software Supply Chain Failures covers compromise and failures occurring across the entire software development and distribution ecosystem.

For example, a business web application may depend on hundreds of direct and transitive packages. One of those packages may be vulnerable. However, a build process controlled by an untrusted party, a compromised build process, or an employment artifact deployed without control may also create risk.

First fix: Automate the process of dependency monitoring and control the update process of your applications. Map OWASP's CWEs to your applications and remediate anything mapped to the third-party category.

A04: 2025 Cryptographic Failures

Cryptographic Failures occur when data is protected by weak cryptography, hash functions, random numbers, certificates or keys. OWASP ranks this failure as the fourth most critical in 2025, down from the second most critical in 2021.

Not rotating keys, sharing or exposing cryptographic keys, implementing weak hashing algorithms to protect data, or using weak crypto algorithms to protect data are common failures.

First fix: Use cryptographic libraries, or established cryptographic frameworks, instead of relying on yourself or your organization to implement crypto functions.

A05: 2025 Injection

Injection attacks occur when a command or query is altered by malicious input, thereby causing the interpreter to behave in an unintended manner. This includes, but is not limited to, SQL injection and cross-site scripting.

For example, a reporting application concatenates a parameter, supplied by the end-user, to a SQL statement. A malicious user supplies an SQL statement that causes the application to retrieve data the user is not authorized to view.

First fix: keep data and commands separate. Parameterize and encode commands and queries. Implement context-specific output encoding and server-side validations.

A06: 2025 Insecure Design

Insecure Design occurs when controls do not exist at the architecture, requirements, or business-logic level. OWASP explains that design flaws and implementation flaws differ, as correcting code cannot address a security flaw in a design.

For example, a subscription-based service allows users to downgrade an account. Due to a design flaw, the user is allowed to keep access to premium features, even if the account is downgraded.

First fix: Include threat modeling and security requirements during product discovery and architecture.

A07: 2025 Authentication Failures

Authentication Failures occur when an application mishandles user credentials, sessions, recovery, or verification. OWASP moved this category to number 7 from number 11, and renamed it from Identification and Authentication Failures.

Examples include weak password recovery, credential stuffing, session fixation, poor logout, default credentials, and missing Multi-Factor Authentication.

First fix: Use proper session management and authentication mechanisms, implement Multi-Factor Authentication for high-risk services, protect credential recovery mechanisms, and implement correct session invalidation.

SaaS teams comparing implementation approaches may find Xcentric's JWT vs session authentication guide to be of interest.

A08: 2025 Software or Data Integrity Failures

Software or Data Integrity Failures occur when an application trusts software or data without verifying it has not been altered. OWASP keeps this category at number 8, but changed its name from the 2021 version.

For example, a business application deserializes untrusted data, or an application trusts a software artifact without verifying its integrity.

First fix: Trust Boundaries. Verify the authenticity and integrity of software and data.

A09: 2025 Security Logging and Alerting Failures

Security Logging and Alerting Failures happen when important security events are not logged or monitored. OWASP expanded the vulnerable component concept to cover the full software ecosystem, like build and dependency systems and software distribution. OWASP also moved SSRF to A01:2025 Broken Access Control, if the application has unusual architecture and business risk. A Payment Platform may need to focus on cryptographic controls and the integrity of transactions. A multi-tenant SaaS platform may need to focus on authorization and adequately defend against unauthorized access and privilege escalation. OWASP renamed the 2021 category to reflect that logging is of little value if events are not meaningfully alerted and responded to.

A SaaS Platform may log successful logins but fail to log or monitor repeated failed login attempts, changes in privilege, or suspicious API activities.

First fix: Identify security events and log them. Events should be alerted meaningfully. Logs should not disclose sensitive information and should be protected from being modified.

A10: 2025 Mishandling of Exceptional Conditions

The Mishandling of Exceptional Conditions category of the 2025 OWASP Top 10 covers a variety of conditions including improper error handling, failure to validate input, and unexpected behavior. 24 CWEs are mapped to this category by OWASP.

Example failure modes may include a payment workflow leaving an account in an inconsistent state after a failure or an authorization check failing open due to an unexpected response from a downstream system.

First fix: define secure failure behavior for important workflows. This means validating return values, handling exceptions, rolling back transactions, and failing closed when a security decision cannot be made safely.

OWASP Top 10 2025 Categories and Associated CWEs

These mappings come from OWASP’s 2025 category pages. OWASP states the 2025 edition contains 248 CWEs across the 10 categories, with category sizes capped at 40.

What Changed in OWASP Top 10 2021 vs 2025?

According to OWASP’s comparison of 2021 vs 2025, two new categories were added to the 2025 edition, as was a significant expansion of a category. Numerous ranking changes were also made, as were the renames of two categories. Finally, SSRF was moved to Broken Access Control.

The most important change is A03:2025. OWASP changed the vulnerable component concept to cover the whole software ecosystem, like dependencies and build and supply chain components. Additionally, OWASP moved SSRF to A01:2025 Broken Access Control.

The rankings are not absolute values for severity. The OWASP approach is to marry important-to-practice data with survey data of security practitioners. Some of the critical risks are difficult to identify at scale.

Is the OWASP Top 10 a Compliance Requirement or Security Standard?

The 2025 version of the OWASP Top 10 is a standard level of awareness for developers and web application security and a broad consensus of the most critical web application risks.

The distinction is important when a customer, investor, procurement agent, or executive asks, "Are you OWASP Top 10 compliant?" There is no broad, universal OWASP Top 10 certification to demonstrate that an application satisfies all the requirements of the OWASP Top 10.

A better business question is: Which OWASP Top 10 2025 risks affect our application? What controls do we have? Which weaknesses persist? What evidence supports our security claims?

For regulated businesses, OWASP Top 10 2023 can be one source of information to build an application security program. Depending on the industry and contract, there may be other requirements, standards, laws, frameworks or customer security questionnaires that also apply.

Which OWASP Risks Should Your Business Fix First?

In the case of most custom-built SaaS and business web applications, it makes sense to prioritize Broken Access Control, Security Misconfiguration, Authentication Failures, Injection, Cryptographic Failures and Software Supply Chain Failures. This is Xcentric’s perspective, and should not be interpreted as an OWASP ranking or as an order of universal remediation.

The order may be different for applications with unique architecture or business risk. For example, a payment application may need to prioritize integrity of transactions over cryptographic controls. A multi-tenant SaaS application may want to prioritize authorization and tenant isolation.

This is where a professional application review becomes more useful than just running a vulnerability scanner. A scanner can only identify known technical weaknesses. They may not understand if one customer can access another customer’s data, if there’s a way to abuse the refund workflow to cause a loss, or if a privilege change is against the application’s business rules.

For businesses building or modernizing a custom application, Xcentric Services’ custom web development and full-stack development services can integrate architecture, development, and testing services with security considerations, rather than treating security as an afterthought.

OWASP Top 10 vs API Security Top 10 vs LLM Top 10

OWASP API Security Top 10 focuses on API related threats, while OWASP Top 10 for LLM Applications 2025 focuses on security threats in applications based on Large Language Models (LLMs). Businesses that utilize all three should view them as distinct and complementary resources.

The 2023 edition of the API Security Top 10 is OWASP's second edition and is described as an awareness document focused on the future of API Security. The 2023 edition includes Broken Object Level Authorization and Broken Authentication.

Are you utilizing REST, GraphQL, or other types of APIs in your web application? Then you should be reviewing Authorization and Authentication, configurations and dependencies, encryption and input handling, architectural risks, and failures. The goal is to identify Threat Modeling gaps. In most cases, reviewing the OWASP Top 10 2025 by itself is not enough. Evaluate your API attack surface area. For best practices on API security and related resources, refer to Xcentric's Best Practices for Securing APIs.

Conclusion

The OWASP Top 10 for LLM Applications 2025 identifies risks caused by generative AI and large language model (LLM) applications. The OWASP Gen AI Security Project describes the 2025 list as risks and mitigations concerning the development, deployment, and management lifecycle of LLM applications.

Consequently, a web application that uses an AI chatbot, retrieval-augmented generation, AI agents, or other LLM workflows may require all three viewpoints: general web application security, API security, and AI security.

That involves not just code reviews, but reviewing more. You need to review authorization, authentication, configurations and dependencies, encryption, input handling, architecture, integrity controls, logging, alerting, and failure paths. Its goal is to find out which gaps are usable and prioritize them based on business impact and then implement fixes that can be sustained as the product changes.

Xcentric Services serves the web development, custom software development, SaaS, enterprise portal, and digital product verticals, and the development lifecycle includes architecture, development, testing, QA and release.