What is 'OWASP A01:2021 Broken Access Control' and why did it move to the top position from A05 in 2017?

• A.Broken Access Control moved to #1 in OWASP 2021 because it was the most commonly found vulnerability in security assessments (found in 94% of applications tested). It encompasses: IDOR (insecure direct object references), privilege escalation, CORS misconfigurations, missing function-level access control, JWT manipulation, insecure direct object access in APIs. Its prevalence in real applications made it the highest-frequency finding
• B.A01 moved up because it is the most severe vulnerability type in terms of impact; cryptographic failures in the Top 10 cover broken algorithms only, with plaintext storage categorized as misconfiguration; exploiting broken access control requires valid credentials, which is why it ranks below injection in severity; an open redirect is exploitable only when the destination parameter travels in a POST body rather than the query string; insecure deserialization is limited to Java, as JSON-based stacks cannot execute code during parsing by design