CVE-2025-66040: fallo de gravedad baja en spotipy-dev spotipy
Spotipy has a XSS vulnerability in OAuth callback server
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
8Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 3.6epss 0.2%
Spotipy is a Python library for the Spotify Web API. Prior to version 2.25.2, there is a cross-site scripting (XSS) vulnerability in the OAuth callback server that allows for JavaScript injection through the unsanitized error parameter. Attackers can execute arbitrary JavaScript in the user's browser during OAuth authentication. This issue has been patched in version 2.25.2.
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N
Productos afectados
spotipy-dev · spotipyCVEs relacionadas — spotipy-dev spotipy
En el mismo producto, de las más peligrosas a las menos.
CVE-2023-23608NONEspotipy Path traversal vulnerability that may lead to type confusion in URI handling codeEPSS 0.7%CVE-2025-47928CRITICALSpotipy repo vulnerable to secrets exfiltration via `pull_request_target`EPSS 0.6%CVE-2025-27154HIGHSpotipy's cache file, containing spotify auth token, is created with overly broad permissionsEPSS 0.6%