A01:2021
Broken Access Control |
Users acting outside of intended permissions (IDOR, privilege escalation, unprotected administrative routes). |
Enforce deny-by-default access policies. Validate resource ownership server-side on every request using robust Role-Based Access Control (RBAC). |
A02:2021
Cryptographic Failures |
Sensitive data exposure through weak or outdated hashing (MD5, SHA1), hardcoded encryption keys, or unencrypted HTTP transit. |
Adopt modern password hashing algorithms (Argon2id, Bcrypt). Encrypt data-at-rest using AES-256-GCM and enforce TLS 1.3 with HSTS headers. |
A03:2021
Injection |
Hostile user input interpreted as commands (SQL Injection, Cross-Site Scripting / XSS, OS Command Injection via system/exec). |
Always utilize parameterized queries (Prepared Statements), context-aware output encoding (htmlspecialchars/Blade), and avoid raw shell execution functions. |
A04:2021
Insecure Design |
Fundamental architectural flaws created before code was written (lack of rate limiting, unauthenticated password reset endpoints). |
Incorporate Threat Modeling early in design phases. Enforce rate limiting across authentication endpoints and establish secure-by-default component patterns. |
A05:2021
Security Misconfiguration |
Default credentials left active, debug modes exposed in production (APP_DEBUG=true), or missing HTTP security headers. |
Disable verbose debug modes in production environments, enforce strict Content-Security-Policy (CSP) headers, and audit cloud infrastructure settings. |
A06:2021
Vulnerable Components |
Third-party packages (npm, Composer, Pip) running known CVE vulnerabilities or unmaintained dependencies. |
Regularly audit external libraries using composer audit or npm audit. Maintain active automated dependency update pipelines. |
A07:2021
Identification & Auth |
Weak credential policies, missing brute-force protection, credential stuffing vulnerabilities, or session fixation flaws. |
Implement Multi-Factor Authentication (MFA), require passwords of at least 8 characters (NIST SP 800-63B), and regenerate session IDs post-login. |
A08:2021
Software Integrity |
Applications executing untrusted code updates or deserializing hostile object streams without cryptographic validation. |
Avoid native language object deserialization with untrusted input; prefer strict JSON serialization. Digitally sign and verify auto-updates. |
A09:2021
Security Logging Failures |
Insufficient audit trails for authentication events, privilege escalation, or security exceptions, hindering breach detection. |
Record security-relevant events with precise UTC timestamps. Ensure logs never capture raw passwords or PII, and forward to SIEM monitors. |
A10:2021
SSRF |
Web server manipulated into making requests to internal or arbitrary endpoints (Server-Side Request Forgery). |
Sanitize and strictly whitelist destination domains and protocols. Block access to cloud instance metadata services (169.254.169.254) and RFC 1918 subnets. |