A06:2025 Insecure Design

OWASP Top 10:2025 · Back to the list

Design-level weaknesses — missing or flawed controls baked into the architecture, irrespective of implementation quality.

Member CWEs (39)

CWE-73 External Control of File Name or Path
CWE-183 Permissive List of Allowed Inputs
CWE-256 Plaintext Storage of a Password
CWE-266 Incorrect Privilege Assignment
CWE-269 Improper Privilege Management
CWE-286 Incorrect User Management
CWE-311 Missing Encryption of Sensitive Data
CWE-312 Cleartext Storage of Sensitive Information
CWE-313 Cleartext Storage in a File or on Disk
CWE-316 Cleartext Storage of Sensitive Information in Memory
CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CWE-382 J2EE Bad Practices: Use of System.exit()
CWE-419 Unprotected Primary Channel
CWE-434 Unrestricted Upload of File with Dangerous Type
CWE-436 Interpretation Conflict
CWE-444 Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
CWE-451 User Interface (UI) Misrepresentation of Critical Information
CWE-454 External Initialization of Trusted Variables or Data Stores
CWE-472 External Control of Assumed-Immutable Web Parameter
CWE-501 Trust Boundary Violation
CWE-522 Insufficiently Protected Credentials
CWE-525 Use of Web Browser Cache Containing Sensitive Information
CWE-539 Use of Persistent Cookies Containing Sensitive Information
CWE-598 Use of HTTP Request With Sensitive Query String
CWE-602 Client-Side Enforcement of Server-Side Security
CWE-628 Function Call with Incorrectly Specified Arguments
CWE-642 External Control of Critical State Data
CWE-646 Reliance on File Name or Extension of Externally-Supplied File
CWE-653 Improper Isolation or Compartmentalization
CWE-656 Reliance on Security Through Obscurity
CWE-657 Violation of Secure Design Principles
CWE-676 Use of Potentially Dangerous Function
CWE-693 Protection Mechanism Failure
CWE-799 Improper Control of Interaction Frequency
CWE-807 Reliance on Untrusted Inputs in a Security Decision
CWE-841 Improper Enforcement of Behavioral Workflow
CWE-1021 Improper Restriction of Rendered UI Layers or Frames
CWE-1022 Use of Web Link to Untrusted Target with window.opener Access
CWE-1125 Excessive Attack Surface

Mapped NIST 800-53 r5 controls (28)

Our two-way, human-QA’d reading of how this category and each NIST 800-53 control relate. No external body publishes an OWASP→800-53 mapping, so these are our assessment.

Direction: ← other covers this; → this covers other (F/M/P = full / mostly / partial). gov = governs / implements (a mandate, not coverage).

Tagged CVEs (showing 50 most recent of 19,374)

Data: OWASP Top 10:2025 (CC BY-SA 4.0) · CWE memberships from cwe-api.mitre.org (meta-category CWE-1441).