In both the 2021 and 2025 OWASP Top 10, which category is ranked #1?
Options
- Injection
- Broken Access Control (Correct option)
- Cryptographic Failures
- Security Misconfiguration
Answer
Broken Access Control
Why
The OWASP Top 10 is the best-known list of the most critical web application security risks.
Broken Access Control (users doing or seeing things they should not be allowed to) is #1: it is very common and often severe.
Defense: check permissions on the server for every request and every object, and deny by default.
Remember
#1 web risk: broken access control.