OWASP Evolution
Theme

Insecure DesignA06: Insecure Design · 2025

The system lacks necessary controls by design, even if the implementation has no individual bug

Summary

The system lacks necessary controls by design, even if the implementation has no individual bug. Risk originates in requirements, trust boundaries and insecure flows.

How the attack works

A06 · How the attack worksA user repeats a discount in the purchase flow because the design neither defines nor enforces a usage limit, abusing business logic.CartWELCOME10Discount +10Repeat without limitMissing rule: one use per customer

A user repeats a discount in the purchase flow because the design neither defines nor enforces a usage limit, abusing business logic.

Example

Vulnerable · Pseudocode
POST /cart/apply-coupon
{"code": "WELCOME10"}
cart.discount += 10

Fix: Define one use per customer and enforce it atomically on the server.

Prevention

  • Perform threat modeling and define verifiable security requirements.
  • Use secure patterns, business limits and separation of responsibilities.
  • Test abuse scenarios during design, development and review.

Lineage

  1. 2021 · A04: Insecure Design New in 2021
  2. 2025 · A06: Insecure Design Moves down from rank 4
  • 2021:A04 → 2025:A06: Insecure Design moves down from rank 4 to 6.

Sources

Buy me a coffee

OWASP Evolution

Editions
Continues / movesContinues RenamedRenamed Merged / expandedMerged