CVE catalog
CVE-2025-66040
DEBIAN-CVE-2025-66040
- Severity
- Unknown
- Published
- Updated
- Source
- [NVD] · [CVE record]
- EPSS
- 0.16% · Oct 25, 2026
Spotipy is a Python library for the Spotify Web API. Prior to version 2.25.2, there is a cross-site scripting (XSS) vulnerability in the OAuth callback server that allows for JavaScript injection through the unsanitized error parameter. Attackers can execute arbitrary JavaScript in the user's browser during OAuth authentication. This issue has been patched in version 2.25.2.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Debian | spotipy | 13 | 2.25.1-1 | vulnerable |
| Debian | spotipy | 13 | 2.25.2-1 | vulnerable |
| Debian | spotipy | 13 | 2.26.0-1 | vulnerable |
| Debian | spotipy | 14 | 2.25.1-1 | vulnerable |
| Debian | spotipy | 14 | 2.25.2-1 | fixed |
| Opensuse | python-spotipy | tumbleweed | 2.25.2-1.1 | fixed |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Debian | spotipy | deb | 14 | 2.25.2-1 | Not reported | DEBIAN-CVE-2025-66040 | Not reported |
| Opensuse | python-spotipy | rpm | tumbleweed | 2.25.2-1.1 | Not reported | OPENSUSE-SU-2025:15777-1 | Not reported |
OpenFactory catalog packages
[Debian 13 (Trixie)]
- [python3-spotipy]Affected
Source package: [spotipy]
Details (2)
2.25.1-1· all · trixieAffected
pypi · spotipy · debian · 13
2.25.1-1· all · trixieAffected
pypi · spotipy · debian · 13
[openSUSE Tumbleweed]
- [python313-spotipy]Unknown
Source package: [python-spotipy]
Details (1)
2.26.0-1.3· noarch · tumbleweedUnknown · Fixed:
2.25.2-1.1Version impact unknown
pypi · python-spotipy · opensuse · tumbleweed
- [python314-spotipy]Unknown
Source package: [python-spotipy]
Details (1)
2.26.0-1.3· noarch · tumbleweedUnknown · Fixed:
2.25.2-1.1Version impact unknown
pypi · python-spotipy · opensuse · tumbleweed
Observed: