CVE-2025-27154

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-27154
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-27154.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-27154
Aliases
Downstream
Related
Published
2025-02-27T13:53:54Z
Modified
2026-08-12T03:51:45Z
Severity
  • 8.4 (High) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
Spotipy's cache file, containing spotify auth token, is created with overly broad permissions
Details

Spotipy is a lightweight Python library for the Spotify Web API. The CacheHandler class creates a cache file to store the auth token. Prior to version 2.25.1, the file created has rw-r--r-- (644) permissions by default, when it could be locked down to rw------- (600) permissions. This leads to overly broad exposure of the spotify auth token. If this token can be read by an attacker (another user on the machine, or a process running as another user), it can be used to perform administrative actions on the Spotify account, depending on the scope granted to the token. Version 2.25.1 tightens the cache file permissions.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-276"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/27xxx/CVE-2025-27154.json"
}
References

Affected packages

Git / github.com/spotipy-dev/spotipy

Affected ranges

Type
GIT
Repo
https://github.com/spotipy-dev/spotipy
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
103d6873facdf7a4943437c8f903c2f6a9c2deb7
Fixed
1ca453f6ef87a2a9e9876f52b6cb38d13532ccf2
Database specific
Show details 
{
    "cpe": "cpe:2.3:a:spotipy_project:spotipy:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "2.25.1"
        }
    ],
    "source": [
        "CPE_RANGE",
        "REFERENCES"
    ]
}

Affected versions

2.*
2.10.0
2.11.0
2.11.1
2.11.2
2.12.0
2.13.0
2.14.0
2.15.0
2.16.0
2.16.1
2.17.0
2.17.1
2.18.0
2.19.0
2.20.0
2.21.0
2.22.0
2.22.1
2.23.0
2.24.0
2.25.0
2.5.0
2.6.0
2.6.1
2.6.2
2.6.3
2.7.0
2.7.1
2.8.0
2.9.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-27154.json"