CVE catalog

CVE-2025-27154

python311-spotipy-2.25.1-1.1 on GA media

[CVE catalog]

Severity
Critical · CVSS 9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Published
Updated
Source
[NVD] · [CVE record]
EPSS
0.61% · Oct 25, 2026

Spotipy is a lightweight Python library for the Spotify Web API. The `CacheHandler` class creates a cache file to store the auth token. Prior to version 2.25.1, the file created has `rw-r--r--` (644) permissions by default, when it could be locked down to `rw-------` (600) permissions. This leads to overly broad exposure of the spotify auth token. If this token can be read by an attacker (another user on the machine, or a process running as another user), it can be used to perform administrative actions on the Spotify account, depending on the scope granted to the token. Version 2.25.1 tightens the cache file permissions.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianspotipy132.25.1-1fixed
Debianspotipy142.25.1-1fixed
Opensusepython-spotipytumbleweed2.25.1-1.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianspotipydeb132.25.1-1Not reportedDEBIAN-CVE-2025-27154Not reported
Debianspotipydeb142.25.1-1Not reportedDEBIAN-CVE-2025-27154Not reported
Opensusepython-spotipyrpmtumbleweed2.25.1-1.1Not reportedOPENSUSE-SU-2025:14847-1Not reported

OpenFactory catalog packages

[openSUSE Tumbleweed]

  • [python313-spotipy]Unknown

    Source package: [python-spotipy]

    Details (1)

    • 2.26.0-1.3 · noarch · tumbleweed

      Unknown · Fixed: 2.25.1-1.1

      Version impact unknown

      pypi · python-spotipy · opensuse · tumbleweed

  • [python314-spotipy]Unknown

    Source package: [python-spotipy]

    Details (1)

    • 2.26.0-1.3 · noarch · tumbleweed

      Unknown · Fixed: 2.25.1-1.1

      Version impact unknown

      pypi · python-spotipy · opensuse · tumbleweed

[Debian 13 (Trixie)]

  • [python3-spotipy]Fixed

    Source package: [spotipy]

    Details (2)

    • 2.25.1-1 · all · trixie

      Fixed · Fixed: 2.25.1-1

      pypi · spotipy · debian · 13

    • 2.25.1-1 · all · trixie

      Fixed · Fixed: 2.25.1-1

      pypi · spotipy · debian · 13

Observed:

References

[FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]