CVE-2025-66040lowCWE-79

CVE-2025-66040: low-severity vulnerability in spotipy-dev spotipy

Spotipy has a XSS vulnerability in OAuth callback server

Published · Updated

Follow this CVE+ Monitor spotipy+ Monitor spotipy

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

8Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 3.6epss 0.2%
Spotipy is a Python library for the Spotify Web API. Prior to version 2.25.2, there is a cross-site scripting (XSS) vulnerability in the OAuth callback server that allows for JavaScript injection through the unsanitized error parameter. Attackers can execute arbitrary JavaScript in the user's browser during OAuth authentication. This issue has been patched in version 2.25.2.
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N
Affected products
spotipy-dev · spotipy
Related CVEs — spotipy-dev spotipy

In the same product, most dangerous first.

CVE-2023-23608NONEspotipy Path traversal vulnerability that may lead to type confusion in URI handling codeEPSS 0.7%CVE-2025-47928CRITICALSpotipy repo vulnerable to secrets exfiltration via `pull_request_target`EPSS 0.6%CVE-2025-27154HIGHSpotipy's cache file, containing spotify auth token, is created with overly broad permissionsEPSS 0.6%