CVE-2025-27154highCWE-276

CVE-2025-27154: falha de alta gravidade em spotipy-dev spotipy

Spotipy's cache file, containing spotify auth token, is created with overly broad permissions

Publicada em

Seguir esta CVE+ Monitorar spotipy+ Monitorar spotipy

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 8.4epss 0.6%
Spotipy is a lightweight Python library for the Spotify Web API. The `CacheHandler` class creates a cache file to store the auth token. Prior to version 2.25.1, the file created has `rw-r--r--` (644) permissions by default, when it could be locked down to `rw-------` (600) permissions. This leads to overly broad exposure of the spotify auth token. If this token can be read by an attacker (another user on the machine, or a process running as another user), it can be used to perform administrative actions on the Spotify account, depending on the scope granted to the token. Version 2.25.1 tightens the cache file permissions.
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Produtos afetados
spotipy-dev · spotipy
CVEs relacionadas — spotipy-dev spotipy

No mesmo produto, das mais perigosas para as menos.

CVE-2023-23608NONEspotipy Path traversal vulnerability that may lead to type confusion in URI handling codeEPSS 0.7%CVE-2025-47928CRITICALSpotipy repo vulnerable to secrets exfiltration via `pull_request_target`EPSS 0.6%CVE-2025-66040LOWSpotipy has a XSS vulnerability in OAuth callback serverEPSS 0.2%