CVE-2025-27154highCWE-276

CVE-2025-27154: fallo de gravedad alta en spotipy-dev spotipy

Spotipy's cache file, containing spotify auth token, is created with overly broad permissions

Publicada el

Seguir esta CVE+ Monitorear spotipy+ Monitorear spotipy

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

21Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 8.4epss 0.6%
Spotipy is a lightweight Python library for the Spotify Web API. The `CacheHandler` class creates a cache file to store the auth token. Prior to version 2.25.1, the file created has `rw-r--r--` (644) permissions by default, when it could be locked down to `rw-------` (600) permissions. This leads to overly broad exposure of the spotify auth token. If this token can be read by an attacker (another user on the machine, or a process running as another user), it can be used to perform administrative actions on the Spotify account, depending on the scope granted to the token. Version 2.25.1 tightens the cache file permissions.
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Productos afectados
spotipy-dev · spotipy
CVEs relacionadas — spotipy-dev spotipy

En el mismo producto, de las más peligrosas a las menos.

CVE-2023-23608NONEspotipy Path traversal vulnerability that may lead to type confusion in URI handling codeEPSS 0.7%CVE-2025-47928CRITICALSpotipy repo vulnerable to secrets exfiltration via `pull_request_target`EPSS 0.6%CVE-2025-66040LOWSpotipy has a XSS vulnerability in OAuth callback serverEPSS 0.2%