Top 10 Spookiest Web App Vulnerabilities

Vulnerabilities don’t need hockey masks or dirty jackets to frighten people. Whether AppSec knows they exist or not, these threats sit in the shadows, waiting to be weaponized.

For years, defenders focused on securing obvious perimeter hazards: server misconfigurations, default settings, unbarred admin panels, open storage buckets. You might hope that a new year (and a few zombie apocalypses later) would bring a completely new cast of monsters.

The scariest part of our 2026 pentest data isn't a sudden, shocking twist. It's the horrifying realization that the call is still coming from inside the house.

The monsters haven't changed; they've just settled in. For the second year in a row, the undisputed heavyweight champion of horrors is a door where nobody checks who or what is actually among us. Missing access control accounts for 41.9% of all web app findings in our 2026 data, keeping a vice-like grip on the #1 spot it held last year.

Let’s dive into the numbers, because the true terror lies in how immovable these threats are. Look at the top of the table. Missing access control, XSS, and server-side injection make up 75.2% of grave findings. Last year? Those same three accounted for 77.9%. The risk isn’t spreading out; it’s congregating in the dark, and we still haven't found the light switch.

The Hierarchy of Horror

1. Missing access control (41.9%): The phantom in the restricted wing. This is the Michael Myers of vulnerabilities: relentless, unstoppable, and dominating the landscape across multiple years.

2. Cross-site scripting (21.0%): A classic jump scare that keeps working. Malicious scripts are conjured directly into your trusted pages, lying in wait to ambush unsuspecting users. Its share fell from 26.2% to 21.0% (the biggest drop on the list) but it remains the second most reliable path to account compromise.

3. Server-side injection (12.3%): A ventriloquist's dummy made of malicious code. Attackers bypass the user interface entirely and whisper fatal commands directly to your database or server. One injectable parameter can mean an attacker pulling all the strings.

4. Authentication and sessions (6.7%): Zombified sessions that refuse to stay dead. If you don't properly terminate sessions after a logout or a timeout, attackers can resurrect them. It moved up one spot from #5 last year and was the only category to grow meaningfully in raw findings (50 to 65), even as total findings fell.

5. Server security misconfiguration (5.4%): The creepy old house with an unlatched cellar door. This category crept up from 4.3% last year, swapping places with sensitive data exposure to take #5. While automated scanners act like motion-sensor floodlights and catch many of these haunted defaults (like open AWS buckets), attackers are still finding ways through the cracks before the house is fully barricaded.

6. Sensitive data exposure (3.8%): Skeletons tumbling out of the closet, though fewer of them this year, as the category slid from #4 (4.6%) to #6 (3.8%). Whether it’s unencrypted PII or hardcoded credentials left in a public repository, these are the secrets rising from the grave.

7. Cross-site request forgery (2.0%): Voodoo dolls for web apps. CSRF forces your authenticated users to unwittingly carry out an attacker's dark bidding. It crept up from #8 last year.

8. Business logic (1.6%): Like a funhouse mirror, business logic flaws twist your intended workflows into unnatural shapes. Like skipping a payment step or replaying a discount code ad infinitum. Nothing is technically broken, which is exactly why automated scanners are completely blind to them.

9. Authorization and privilege escalation (1.0%): Classic demonic possession. This is when a low-level mortal suddenly seizes an admin's god-like powers. Combined with its close cousin (Missing Access Control), these flaws prove that keeping the wrong entities out of the wrong rooms is our biggest failing.

10. LLM and AI-related vulnerabilities (0.9%): Like a digital Ouija board, these models answer whatever spirits summon them, and attackers are learning exactly which dark incantations to whisper. The overall share in web apps is small, but don’t let that fool you. In our AI pentesting data, 32% of findings in AI and LLM environments rate high or critical, compared with about 12% in traditional software. That’s a 2.7x risk multiplier.

Why Missing Access Control Keeps the Vuln Crown

It didn't just take the crown; it kept it. Three dark forces are driving its dominance:

• Scanners Can’t See Ghosts: Automated tools are brilliant at finding known signatures. Access control flaws aren’t signatures; they’re failures of intent. Scanners don’t know that customer A shouldn’t be able to pull customer B’s invoice. A tester does, and proves it by testing across roles, accounts, and tenants.

• The Haunted Hotel of APIs: Modern architecture multiplies the decision points. Every API endpoint, microservice, and object ID is its own room where authorization has to be enforced. Miss one check and the door is wide open. No complex exploit chain required. We’ve built applications with thousands of doors and expected developers to remember every single lock.

• Frankensteining at Warp Speed: Release velocity outpaces review, especially with AI-directed development. New features ship with new endpoints, and the authorization logic has to be stitched together every time. Testing struggles to keep pace with the monster we're building.

Predictions for Next Year

The Sorcerer’s Apprentice Problem: AI Moves from Whispers to Weaponized Actions

In 2025, 84.5% of our AI/LLM findings were AI-specific flaws: prompt injection, jailbreaks, insecure output handling, excessive agency. In 2026, that share dropped to 59.9% as traditional application flaws took over. Most alarming: missing access control in AI environments more than doubled, from 6.2% to 15.3% (6 findings to 24), and server misconfigurations went from a single finding to ten (1.0% to 6.4%).

The Horror in 2027: The threat is mutating from what the model says to what the model is allowed to do. As companies wire LLMs into autonomous agents, enterprise databases, and internal APIs, the real terror won't be a chatbot reciting spooky poetry. It will be an agent with excessive agency that blindly fetches another customer's data or executes commands because nobody enforced tenant isolation on the underlying tools.

The Cursed Assembly Line: AI-Generated Code Mass-Produces Missing Access Control

Missing access control’s share didn’t budge this year, and the way code is being written suggests it won’t next year either.

The Horror in 2027: Development velocity is accelerating as engineering teams adopt AI-assisted coding tools. The catch? LLMs write syntactically pristine code that sails through linters and static scanners, but they have zero conceptual awareness of business intent or tenant boundaries. In our testers’ experience, when you ask an AI assistant to spin up a quick CRUD endpoint, it rarely includes object-level authorization checks (BOLA/IDOR) unless explicitly coached to do so.

Phantom Identities: Authentication & Session Management Creeps Higher

While total web app findings fell about 14% year over year, Authentication and Sessions grew against the tide: 4.5% to 6.7% of findings, a 30% jump in raw count and a 50% surge in share. This is the biggest increase of any category.

The Horror in 2027: Modern architectures are a labyrinth of microservices, third-party Identity Providers (IdPs), OAuth delegations, and headless API gateways. Invalidating a user's session isn't as simple as deleting a local cookie anymore. Stale tokens, improper session termination across distributed services, and OAuth redirect flaws are creating "zombie sessions" that linger long after a user logs out. This gives attackers an open door to impersonate legitimate users without ever cracking a password.

The Slasher Sequel Rule: XSS Weakens, But Never Truly Dies

Cross-Site Scripting dropped from 26.2% to 21.0% of web app findings, and raw XSS findings fell by nearly a third. Modern front-end frameworks (React, Angular, Vue) with built-in context-aware escaping are finally helping defenders lock the front windows.

The Horror in 2027: Don't turn your back on the body. XSS is the quintessential horror villain. Just when you think it's buried, it finds a new mask. As web apps integrate markdown parsers, rich-text renderers for generative AI responses, and complex client-side routing, pentesters are already seeing XSS resurrect via DOM-based vulnerabilities and unsafe output handling from LLM interfaces. It may lose a few percentage points, but it won't leave the podium.

Survival Guide

• Test Authorization Explicitly: Don't just check the locks at the front door (login). Verify access at the object level, across every role, and enforce strict trust boundaries between components. A low-privileged user chatting with an over-privileged AI is the perfect recipe for an initial foothold or malicious action.

• Prioritize the Horde: Three categories have made up more than 75% of findings two years running. Fix authorization, output encoding, and input handling before anything else.

• Tame the AI/LLM Monster: AI/LLM deployments carry a 2.7x risk multiplier, so strictly enforce tenant isolation and bound what autonomous agents are allowed to do.

• Bury Zombie Sessions: Authentication issues are surging, so implement robust session termination across distributed microservices to prevent stale tokens from lingering

• Don’t Trust a Clean Scan: A clean vulnerability scan doesn't mean a locked door. Access control and business logic flaws require a living, breathing human who understands how the application is supposed to behave vs. how it actually behaves.

• Test While Shipping: Authorization logic mutates with every release. A once-a-year pentest can’t keep pace with a living application. Cobalt Core, our network of vetted pentesters, hunts for these exact flaws and delivers validated findings through the Cobalt Platform before the real monsters find them.

Cheers, and stay vigilant. Because as the data shows, the scariest threats aren't breaking down the front door—they’re already inside the house.