The OWASP Application Security Verification Standard (ASVS) v5.0 has reached the release candidate stage. The project’s contribution guide announces the final 5.0 release for May 2025 and calls it a complete revamp compared to 4.0.3. The draft is organised into 17 chapters, including ones on self-contained tokens, OAuth and OIDC, and WebRTC, with the complete standard documentation available for review by development teams and security professionals. The guidance for users of version 4.0 warns that almost every requirement has been modified or renumbered, drops the CWE mappings and the tight coupling to NIST SP 800-63, and rewrites requirements around the security goal rather than a specific mechanism. Anyone whose audit checklists are keyed to 4.0.3 requirement numbers should start budgeting time for the mappings now.
OWASP ASVS v5 nears release
··1 min