Log in Start free

Vulnerability · Published Feb 27, 2025 · Assigned by GitHub_M

CVE-2025-27154Spotipy's cache file, containing spotify auth token, is created with overly broad permissions

High 8.4

In plain English

A high-severity incorrect default permissions in spotipy from spotipy-dev. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 49% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)8.4High
Exploit odds (30 days)0.6%top 50.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Spotipy is a lightweight Python library for the Spotify Web API. The `CacheHandler` class creates a cache file to store the auth token. Prior to version 2.25.1, the file created has `rw-r--r--` (644) permissions by default, when it could be locked down to `rw-------` (600) permissions. This leads to overly broad exposure of the spotify auth token. If this token can be read by an attacker (another user on the machine, or a process running as another user), it can be used to perform administrative actions on the Spotify account, depending on the scope granted to the token. Version 2.25.1 tightens the cache file permissions.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:13spotipy2.25.1-1DEBIAN-CVE-2025-27154
Debian:14spotipy2.25.1-1DEBIAN-CVE-2025-27154
PyPIspotipy2.25.1PYSEC-2026-1936
PyPIspotipy2.25.1GHSA-pwhh-q4h6-w599
Ubuntu:25.10spotipyno fix listedUBUNTU-CVE-2025-27154
Ubuntu:26.04:LTSspotipyno fix listedUBUNTU-CVE-2025-27154
Ubuntu:26.10spotipyno fix listedUBUNTU-CVE-2025-27154

Affected products (as reported)

VendorProductVersions
spotipy-dev spotipy < 2.25.1

Weakness: CWE-276 · Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

References