OWASP Top 10. Mapped to Deva detection.

What it is

Broken access control retains the #1 position in OWASP Top 10:2025. It covers any path by which a user performs an action they should not be authorized to perform: bypassing access checks via URL manipulation, modifying request metadata, accessing another user's resources via Insecure Direct Object Reference (IDOR), elevating privileges, or performing state changes that should require additional confirmation. Modern web frameworks ship with secure-by-default access patterns, but mis-applied or skipped checks remain the dominant root cause of disclosed breaches. The 2025 edition also explicitly includes server-side request forgery patterns under this category (which was previously its own A10:2021 entry).

Common patterns

• •IDOR: fetching a resource by a request-supplied ID without verifying the authenticated user owns or has rights to it.
• •Skipping authorization on backend APIs because the UI does not surface a link to the action.
• •CSRF: state-changing operations that lack a token, SameSite cookie attribute, or origin check.
• •Privilege escalation through parameter tampering (role=admin in a request body).
• •Path traversal allowing read or write of files outside the intended directory.
• •SSRF: server-side fetches against user-supplied URLs without allowlist or IMDS protection.
• •CORS misconfiguration that allows credentialed requests from any origin.

CWE guides Deva ships for A01

Real-world breaches in this category

What it is

Security Misconfiguration moves up from A05:2021 to A02 in 2025, reflecting that configuration drift is now the #2 most common cause of exposure across applications tested. The category covers any deployment state where a system is exposed because of how it is configured, not how it is coded. Examples include cloud storage buckets with public-read access, debug endpoints reachable in production, default credentials never changed, XML parsers with external entities enabled, unnecessary features running on production hosts, and missing security headers (Strict-Transport-Security, Content-Security-Policy, X-Content-Type-Options). XML External Entity (XXE) is consolidated into this category in 2025.

Common patterns

• •S3, GCS, or Azure Blob storage with public-read or list-bucket permissions on private data.
• •XML parsers (lxml, DocumentBuilderFactory, XmlReader) instantiated without disabling external entities (XXE).
• •Verbose error pages or debug endpoints (DEBUG=True in Flask/Django, app.debug=true in Express) live in production.
• •Default credentials on databases, admin panels, or management interfaces.
• •Security headers missing or misconfigured: no HSTS, weak CSP, missing X-Frame-Options.
• •Cloud IAM policies with wildcard resources (Resource: *) on actions that should be scoped.

CWE guides Deva ships for A02

Real-world breaches in this category

What it is

Software Supply Chain Failures is the renamed and significantly expanded successor to A06:2021 Vulnerable and Outdated Components. It moves up to #3 and broadens scope beyond just known-vulnerable dependencies to include all supply chain compromises: malicious packages, build-system attacks, IDE-extension compromises, and unmaintained components. Top-ranked in the 2025 community survey with 50% of respondents placing it #1. OWASP's relevant CWEs include CWE-477 (Obsolete Function), CWE-1104 (Unmaintained Third-Party Components), CWE-1329 (Reliance on Component That is Not Updateable), and CWE-1395 (Dependency on Vulnerable Third-Party Component).

Common patterns

• •Direct or transitive dependencies on packages with published CVEs and available patches.
• •Versions pinned to ranges (^1.2.3) that pull in compromised versions when an upstream account is hijacked.
• •Typosquatting: installing 'reactt' (typo) instead of 'react' and getting an attacker-controlled package.
• •Out-of-date container base images that ship known-vulnerable system libraries.
• •Use of packages whose maintainers have abandoned them, leaving published vulnerabilities unpatched.
• •Build systems (CI/CD, package registries, IDE extensions) compromised upstream of your code.
• •Components installed without integrity hashes or signature verification.

Real-world breaches in this category

What it is

Cryptographic Failures moves down from A02:2021 to A04:2025 as Security Misconfiguration and Supply Chain Failures overtake it in prevalence. The category covers any path by which sensitive data is exposed because of inadequate cryptographic protection. Manifestations include missing encryption in transit or at rest, weak algorithms (DES, MD5, SHA-1 for passwords), hardcoded credentials, weak or predictable random number generation, and improper key management. The consequences of disclosure are often immediate and unrecoverable: leaked passwords cannot be unleaked.

Common patterns

• •Hashing passwords with fast algorithms (MD5, SHA-256) instead of bcrypt, argon2, or scrypt.
• •AES with ECB mode (visible patterns) or CBC without HMAC (padding oracle vulnerabilities).
• •Hardcoded API keys, database passwords, or signing secrets in source code.
• •Math.random or other non-cryptographic PRNGs used for tokens, session IDs, or salts.
• •HTTP endpoints transmitting credentials, tokens, or PII without TLS.
• •Stack traces, debug pages, or error responses that include sensitive system or user data.

CWE guides Deva ships for A04

Real-world breaches in this category

What it is

Injection drops from A03:2021 to A05:2025 but remains a critical category. It covers any vulnerability in which an attacker supplies data that the application then passes to an interpreter (SQL, shell, OS, expression engine, template, LDAP, XPath) without proper validation or parameterization. The interpreter executes the injected content, often granting the attacker the privileges of the application's identity in that subsystem. SQL injection in particular has appeared in every published OWASP Top 10 since the document's inception.

Common patterns

• •SQL queries built by string concatenation or template-string interpolation of user input.
• •Shell commands constructed from request parameters (filename, URL, hostname).
• •eval, new Function, or exec called with user-controlled strings.
• •NoSQL injection through MongoDB query operators accepted from request bodies ($where, $regex).
• •LDAP injection in directory queries built from user input.
• •XSS: HTML or JavaScript injected into pages via unsanitized output.
• •ORM injection: parameterized libraries used incorrectly, or raw queries bypassing the ORM's safety layer.

CWE guides Deva ships for A05

Real-world breaches in this category

What it is

Insecure Design moves from A04:2021 to A06:2025. It covers vulnerabilities that are baked into the system before any line of code is written: business logic flaws (rate limits that are not enforced, password reset flows that allow account takeover by design, file upload features that cannot be safely implemented), missing threat modeling, and reliance on user-supplied trust labels. Unlike injection or auth bugs, insecure design issues persist through code-level fixes because the design itself is the vulnerability.

Common patterns

• •File upload features without a viable threat model (allowed types, storage location, serving behavior).
• •Password reset flows that confirm reset based on knowledge of public information.
• •Rate limits enforced client-side, or applied per IP rather than per identity, or absent entirely.
• •Multi-tenant architectures that scope by request parameter rather than by the authenticated identity.
• •Privileged operations that rely on the absence of a UI link to remain undiscovered ('security by obscurity').
• •Workflows that assume an out-of-band step has occurred when it has not been verified.

CWE guides Deva ships for A06

Real-world breaches in this category

What it is

Authentication Failures (renamed in 2025 from Identification and Authentication Failures, retaining the A07 slot) covers any failure to correctly verify the identity of an entity interacting with the application. Manifestations include missing authentication on critical functions, brute-forceable login flows, weak password policies, predictable session identifiers, JWT validation that decodes but does not verify, and credential stuffing surface area without monitoring. Authentication failures are the foundational weakness behind most disclosed account takeovers and an explicit control area in HIPAA, PCI-DSS, and CMMC.

Common patterns

• •Routes with no authentication middleware on sensitive paths (/admin, /internal, /debug).
• •JWT verification calls with verify:false, missing signing key, or accepting 'alg':'none'.
• •Login flows without rate limiting, account lockout, or CAPTCHA on repeated failures.
• •Password requirements that allow trivially-crackable choices ('a' or '12345').
• •Hardcoded API keys, DB passwords, or signing secrets in source.
• •Session IDs generated from predictable sources (timestamps, weak PRNG, sequential counters).

CWE guides Deva ships for A07

Real-world breaches in this category

What it is

Software or Data Integrity Failures retains its position at A08 in 2025. It covers any path by which untrusted code or data flows into a trust boundary without verification. Examples include insecure deserialization (where an attacker-controlled byte stream is reconstructed into application objects), CI/CD pipelines that trust unauthenticated artifact sources, auto-update mechanisms that fetch updates over insecure channels, and dependencies installed from registries without integrity hashes. The category overlaps with A03:2025 Software Supply Chain Failures but focuses specifically on the integrity-verification gap rather than the broader supply-chain context.

Common patterns

• •Python pickle.load on data from HTTP requests, message queues, or cache backends.
• •Java ObjectInputStream.readObject on data from network sources (gadget-chain RCE).
• •.NET BinaryFormatter on attacker-controlled bytes.
• •PHP unserialize on cookie or query-string values.
• •CI/CD steps that fetch scripts from URLs without hash pinning or signature verification.
• •Package installations without lockfile or integrity-hash verification.

CWE guides Deva ships for A08

Real-world breaches in this category

What it is

Security Logging and Alerting Failures retains A09 in 2025, with a name change from 'Logging and Monitoring' to emphasize the alerting function needed to induce action on relevant logging events. The category covers gaps in the observability stack that let an attack progress undetected: missing logs on auth events, logs that are written but never reviewed, log storage that the attacker can also reach, log formats that lose attribution detail (no user ID, no source IP), and detection rules that exist but are not tuned. OWASP relevant CWEs include CWE-117 (Improper Output Encoding for Logs), CWE-532 (Inserting Sensitive Data into Log Files), and CWE-778 (Insufficient Logging).

Common patterns

• •Authentication and authorization decisions logged at INFO without source IP, user ID, or correlation ID.
• •Failed login attempts not logged at all, or logged without enough metadata to detect credential stuffing.
• •Privilege changes, role assignments, or permission grants not audit-logged.
• •Application logs stored in the same blast radius as the application (attacker who compromises the app also tampers with the logs).
• •Log retention shorter than the typical breach dwell time.
• •Alerts wired to channels (email, low-priority Slack) that are not acted on.

Real-world breaches in this category

What it is

Mishandling of Exceptional Conditions is new to A10:2025, replacing Server-Side Request Forgery (which dropped off the list and is now consolidated under A01:2025 Broken Access Control). The category covers improper error handling, logical errors, failing open, and other scenarios stemming from abnormal conditions that systems may encounter. It consolidates CWEs previously associated with 'poor code quality' into a more actionable category. OWASP's notable CWEs for this category: CWE-209 (Generation of Error Message Containing Sensitive Information), CWE-234 (Failure to Handle Missing Parameter), CWE-274 (Improper Handling of Insufficient Privileges), CWE-476 (NULL Pointer Dereference), and CWE-636 (Not Failing Securely / 'Failing Open').

Common patterns

• •Error handlers that catch exceptions broadly and then ignore them, allowing the application to continue in an undefined state.
• •Failing open: when an authentication or authorization check throws, the request is allowed through instead of rejected.
• •Stack traces or full exception details returned to the client, exposing internal paths, schema, and library versions.
• •Missing input validation that lets unexpected types or formats reach downstream logic.
• •NULL pointer dereferences in languages where checks would prevent crashes (Java, C, C++, Go without proper guards).
• •Transactions that partially complete and are not rolled back when an exceptional condition interrupts them.
• •Race conditions where unexpected timing causes inconsistent state.

Real-world breaches in this category