Vulnerability · Published Nov 26, 2025 · Assigned by GitHub_M

CVE-2025-66040Spotipy has a XSS vulnerability in OAuth callback server

Low 3.6

In plain English

A low-severity cross-site scripting in spotipy from spotipy-dev. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 6% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)3.6Low

Exploit odds (30 days)0.2%top 94.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Spotipy is a Python library for the Spotify Web API. Prior to version 2.25.2, there is a cross-site scripting (XSS) vulnerability in the OAuth callback server that allows for JavaScript injection through the unsanitized error parameter. Attackers can execute arbitrary JavaScript in the user's browser during OAuth authentication. This issue has been patched in version 2.25.2.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Debian:13	spotipy	no fix listed	DEBIAN-CVE-2025-66040
Debian:14	spotipy	2.25.2-1	DEBIAN-CVE-2025-66040
PyPI	spotipy	2.25.2	PYSEC-2026-1937
PyPI	spotipy	2.25.2	GHSA-r77h-rpp9-w2xm
Ubuntu:25.10	spotipy	no fix listed	UBUNTU-CVE-2025-66040
Ubuntu:26.04:LTS	spotipy	no fix listed	UBUNTU-CVE-2025-66040
Ubuntu:26.10	spotipy	no fix listed	UBUNTU-CVE-2025-66040

Affected products (as reported)

Vendor	Product	Versions
spotipy-dev	spotipy	< 2.25.2

Weakness: CWE-79 · Vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N

References

https://github.com/spotipy-dev/spotipy/security/advisories/GHSA-r77h-rpp9-w2xm x_refsource_CONFIRM
https://github.com/spotipy-dev/spotipy/commit/880b92d7243dcf2b83bf31dc365a858d8b5e6767 x_refsource_MISC