CVE-2025-66040
CVE-2025-66040 · Spotipy has a XSS vulnerability in OAuth callback server
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Spotipy is a Python library for the Spotify Web API. Prior to version 2.25.2, there is a cross-site scripting (XSS) vulnerability in the OAuth callback server that allows for JavaScript injection through the unsanitized error parameter. Attackers can execute arbitrary JavaScript in the user's browser during OAuth authentication. This issue has been patched in version 2.25.2.
CVSS 3.6 · Low · EPSS 0.2% · Fix available
- Published
- Updated
Affected products and versions
spotipy
- Versions
- < 2.25.2: Affected
No fix published
spotipy Debian:13
- Versions
- 2.25.1-1
- 2.25.2-1
- 2.26.0-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
spotipy Debian:14
- Versions
- 2.25.1-1
- Affected ranges
- ECOSYSTEM: < 2.25.2-1
Update to 2.25.2-1
spotipy PyPI
- Versions
- 0.1
- 0.2
- 2.0.1
- 2.0.2
- 2.1.0
- 2.10.0
- 2.11.0
- 2.11.1
- 2.11.2
- 2.12.0
- 2.13.0
- 2.14.0
- 2.15.0
- 2.16.0
- 2.16.1
- 2.17.0
- 2.17.1
- 2.18.0
- 2.19.0
- 2.19.0rc1
- 2.2.0
- 2.20.0
- 2.21.0
- 2.22.0
- 2.22.1
- 2.23.0
- 2.24.0
- 2.25.0
- 2.25.1
- 2.3.0
- 2.3.2
- 2.3.3
- 2.3.4
- 2.3.5
- 2.3.6
- 2.3.7
- 2.3.8
- 2.4.0
- 2.4.1
- 2.4.2
- 2.4.3
- 2.4.4
- 2.5.0
- 2.6.0
- 2.6.1
- 2.6.2
- 2.6.3
- 2.7.0
- 2.7.1
- 2.8.0
- 2.9.0
- Affected ranges
- ECOSYSTEM: < 2.25.2
Update to 2.25.2
spotipy Ubuntu:25.10
- Versions
- 2.25.1-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
spotipy Ubuntu:26.10
- Versions
- 2.25.2-1
- 2.26.0-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
spotipy Ubuntu:26.04:LTS
- Versions
- 2.25.1-1
- 2.25.2-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published