PT-2025-8943 · Spotipy · Spotipy

Alichtman · Published 2025-02-27 · Updated 2025-03-03 · CVE-2025-27154

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Spotipy versions prior to 2.25.1

Description The issue concerns the CacheHandler class in Spotipy, which creates a cache file to store the auth token with overly broad permissions. This allows potential exposure of the Spotify auth token, which could be read by an attacker, such as another user on the machine or a process running as another user. If accessed, the token can be used to perform administrative actions on the Spotify account, depending on the scope granted to the token.

Recommendations For versions prior to 2.25.1, update to version 2.25.1 to tighten the cache file permissions and prevent overly broad exposure of the Spotify auth token.

Exploit

Fix

Incorrect Default Permissions

Weakness Enumeration

CWE-276

Related Identifiers

CVE-2025-27154

GHSA-PWHH-Q4H6-W599

OPENSUSE-SU-2025:14847-1

Affected Products

Spotipy

References · 27

• 🔥 https://github.com/spotipy-dev/spotipy/security/advisories/GHSA-pwhh-q4h6-w599 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/27xxx/CVE-2025-27154.json · Exploit
• https://github.com/spotipy-dev/spotipy/commit/1ca453f6ef87a2a9e9876f52b6cb38d13532ccf2 · Patch
• https://ubuntu.com/security/CVE-2025-27154 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-27154 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-27154 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-27154 · Security Note
• https://osv.dev/vulnerability/GHSA-pwhh-q4h6-w599 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2025-27154 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2025:14847-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-27154 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-27154 · Security Note
• https://github.com/spotipy-dev/spotipy/blob/master/spotipy/cache_handler.py#L93-L98 · Note
• https://github.com/spotipy-dev/spotipy/releases/tag/2.25.1 · Note
• https://github.com/spotipy-dev/spotipy · Note