Day 4: OWASP Top 10 Explained — The Official Bug Bounty Vulnerability Map Every Hunter Needs (2026)

What it is: Access controls are the rules that decide who can do what — which users can view which data, which accounts can perform which actions. Broken Access Control means those rules are either missing, improperly implemented, or bypassed. It is the #1 OWASP category because it turned up more often than any other category in OWASP’s testing data — and it directly enables attackers to access data and functions they should not be able to reach.

How it manifests in bug bounty: The most common form is IDOR (Insecure Direct Object Reference) — changing a user ID, order ID, or document ID in a URL or API request and receiving another user’s data. Example: the URL /api/orders/8472 returns your order. Changing it to /api/orders/8473 returns another user’s order. That is IDOR — and it pays $300–$5,000 depending on what data is exposed.

What it is: Previously called “Sensitive Data Exposure,” this category covers failures related to cryptography — specifically when applications transmit or store sensitive data without adequate encryption, use weak or deprecated cryptographic algorithms, or have cryptographic implementations that can be attacked. Cryptographic failures expose passwords, credit card numbers, health records, and personally identifiable information.

Bug bounty examples: Sensitive data transmitted over HTTP instead of HTTPS (password in URL parameter), passwords stored in plaintext or with MD5/SHA1 hashing (instead of bcrypt/argon2), weak JWT secrets that can be cracked, TLS 1.0/1.1 enabled when only 1.2/1.3 should be accepted, and private API keys exposed in JavaScript source files.

What it is: Injection occurs when an application passes untrusted data to an interpreter — a SQL database, an OS shell, an LDAP server, an XML parser — and that interpreter executes the attacker’s input as part of a command or query rather than as data. Injection was the #1 OWASP category for a decade before being displaced by Broken Access Control in 2021. It remains among the most severe vulnerability classes.

What it is: Insecure Design is a new category in 2021, introduced to capture a class of vulnerabilities that tools cannot easily find: flaws in the fundamental logic of how an application works. These are not coding mistakes — they are design mistakes. The application does exactly what the developer intended; it’s the intention itself that is insecure.

Bug bounty examples: A discount code that can be applied multiple times because there’s no check for reuse. A password reset flow that sends the new password to an email that the user’s account email has already been changed to — enabling account takeover. A “free trial” that can be activated indefinitely by creating new accounts with email aliases. A price that can be manipulated by modifying hidden form fields. These are all business logic flaws under the A04 umbrella.

What it is: Security misconfigurations occur when security settings are not defined, implemented, or maintained correctly. This includes default credentials left unchanged, cloud storage buckets left publicly accessible, error messages that reveal stack traces and internal paths, unnecessary features enabled (directory listing, debug endpoints), missing security headers, and services accessible from the internet that should only be internal.

Bug bounty examples you can find as a beginner: Open S3 buckets containing customer files, admin interfaces accessible at /admin or /phpmyadmin, debug endpoints at /actuator or /.env exposed publicly, missing security headers (Content-Security-Policy, X-Frame-Options), directory listing enabled showing internal file structures.

What it is: Applications use frameworks, libraries, plugins, and components built by third parties. When these components have known, publicly disclosed security vulnerabilities (CVEs) and the application has not been updated, it inherits those vulnerabilities. The component version is often visible in HTTP headers, JavaScript files, or HTML comments — making this a reconnaissance-first vulnerability class.

Bug bounty workflow: On Day 3 we learned that HTTP headers and server banners reveal technology versions, and Day 6 recon finds even more of them. A06 combines both — identify the version of every component in use (jQuery, WordPress, Apache, PHP, Bootstrap, Log4j), then check CVE databases (cve.mitre.org, nvd.nist.gov) for known vulnerabilities in that exact version. If the CVE is critical and exploitable, report it.

What it is: Authentication verifies who you are. Session management tracks that verified identity across requests. Identification failures mean the application cannot reliably establish that users are who they claim to be — enabling attackers to assume other identities, including admin accounts. This category pays the most in bug bounty because account takeover is one of the most damaging outcomes an attacker can demonstrate.

What it is: A08 covers situations where software or data is used without verifying its integrity — applications that load plugins from untrusted CDNs without Subresource Integrity checks, insecure deserialisation of untrusted data (where attacker-controlled serialised objects execute code when deserialised), and CI/CD pipelines that accept unsigned code or packages. The 2021 SolarWinds supply chain attack is a real-world example at nation-state scale.

Bug bounty focus: Insecure deserialisation is the most common A08 finding in bug bounty — when applications deserialise user-supplied data (in cookies, hidden fields, or API parameters) without validating it. This often leads to remote code execution, making it one of the highest-severity findings possible. Also look for missing Subresource Integrity on third-party JavaScript files loaded from CDNs.

What it is: Security logging failures mean the application does not adequately record security-relevant events — failed logins, access control violations, input validation failures — and does not alert on suspicious activity. While this is not a directly exploitable vulnerability in the traditional sense, its absence means that breaches go undetected for months. The average breach takes 197 days to detect. Logging failures are why.

Bug bounty perspective: A09 findings are typically low individual payouts but serve as important supporting evidence for other findings. If you demonstrate that your brute force attack generated no alerts, or that your IDOR access to thousands of user records produced no logged event, the severity of the access control finding increases. A09 also covers log injection — inserting newlines into log files to forge log entries (a creative technique covered with CRLF injection on Day 24).

What it is: SSRF occurs when an application fetches a remote resource based on a user-supplied URL without validating that URL. An attacker can supply internal URLs — pointing to internal services, cloud metadata endpoints, or infrastructure — causing the server to make requests on the attacker’s behalf. Since these requests come from the server itself (not the attacker’s IP), they bypass firewalls that would block external access to those internal resources.

Why SSRF is explosive in cloud environments: AWS, GCP and Azure all run an instance metadata service at http://169.254.169.254 that can return temporary cloud credentials and configuration to requests coming from inside the instance. AWS’s older IMDSv1 answers a plain GET request; IMDSv2, GCP and Azure require an extra token or header, which stops many basic SSRF attempts. SSRF that reaches this endpoint — known as “cloud metadata SSRF” — gives the attacker AWS credentials and potential access to the entire cloud account. This finding pays $10,000–$50,000+ at major programmes. It is the most dramatic vulnerability class in modern web security.