A02: Security Misconfiguration

Security Misconfiguration occurs when applications, servers, or frameworks are deployed with insecure default settings, exposed configurations, or improperly set permissions, making them vulnerable to attacks. These misconfigurations often result from unnecessary features, excessive privileges, unhardened defaults, or lack of security hardening, leading to data leaks, unauthorized access, and system compromise. It ranks second in the OWASP Top 10:2025 — a reflection of how much modern risk comes from how software is deployed rather than how it is written.

Common Vulnerabilities:

• Default Credentials or Weak Authentication Configurations
• Unnecessary Features, Services, or Debug Code Enabled in Production
• Overly Permissive Permissions on Files, Directories, or Cloud Resources
• XML External Entity (XXE) Processing Left Enabled in XML Parsers
• Misconfigured Security Headers (Missing CSP, HSTS, or X-Frame-Options)
• Missing Cookie Attributes (Secure, HttpOnly, SameSite)
• Secrets Stored in Configuration Files or Environment Variables
• Permissive Cross-Domain Policies
• Unrestricted Access to Admin Panels or APIs

To mitigate these risks, applications should disable unnecessary features, enforce secure authentication and access controls, harden framework and server defaults, configure security headers and cookie attributes properly, and perform security audits to detect misconfigurations. Automating configuration management and using security baselines can further reduce exposure to misconfigurations.

Last updated 2026-08-19