CVE-2025-27154 Details
Description
Spotipy is a lightweight Python library for the Spotify Web API. The `CacheHandler` class creates a cache file to store the auth token. Prior to version 2.25.1, the file created has `rw-r--r--` (644) permissions by default, when it could be locked down to `rw-------` (600) permissions. This leads to overly broad exposure of the spotify auth token. If this token can be read by an attacker (another user on the machine, or a process running as another user), it can be used to perform administrative actions on the Spotify account, depending on the scope granted to the token. Version 2.25.1 tightens the cache file permissions.
A vulnerability exists in Spotipy, a Python library for the Spotify Web API, in versions prior to 2.25.1. The issue arises in the CacheFileHandler class, where the cache file storing the authentication token is created with overly permissive 'rw-r--r--' (644) permissions by default. This misconfiguration allows unauthorized access to the Spotify auth token, which could be exploited by another user on the same machine or a process running under a different user account. Depending on the token's scope, this could lead to unauthorized administrative actions on the Spotify account.
Users can upgrade to Spotipy version 2.25.1 or later, where the cache file permissions have been tightened to 'rw-------' (600), preventing unauthorized local access to the auth token.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Feb 27, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-276 | Incorrect Default Permissions | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| spotipy project spotipy | < 2.25.1 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 7, 2025 | Initial Analysis | [email protected] |
| Feb 27, 2025 | CVE Modified | CISA-ADP |
| Feb 27, 2025 | New CVE Received | [email protected] |