Skip to content
OpenAdvisories

Vendor

spotipy-dev

4 known vulnerabilities.

Products

spotipy 4
All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • High 8.4
    CVE-2025-27154

    Spotipy's cache file, containing spotify auth token, is created with overly broad permissions

    Spotipy is a lightweight Python library for the Spotify Web API. The `CacheHandler` class creates a cache file to store the auth token. Prior to version 2.25.1, the file created has `rw-r--r--` (644) permissions by default, when it could be locked down to `rw…

    spotipy-dev spotipy spotipy spotipy Debian Ubuntu PyPI