Security Misconfiguration
Moved from 5th in 2021 to 2nd in 2025. Default configs, open admin and debug surfaces, loose CORS, missing headers, public object storage, and unnecessary features. OWASP reported about 3.00% of tested applications had one or more of 16 CWEs here, and…
OWASP rank: 2
Practical checks
- Inventory exposed panels, .git, backups, and debug endpoints before any exploit attempt
- Compare security headers and CORS on the app shell versus error and asset responses
- Check object storage and CDN paths for public listing or predictable keys
- Read verbose errors for stack traces, tenant names, and internal hostnames
- Record which behavior is config, which is code, and which is a default you did not change