CVE-2025-27154

Spotipy is a lightweight Python library for the Spotify Web API. The "CacheHandler" class creates a cache file to store the auth token. Prior to version 2.25.1, the file created has "rw-r--r--" 644 permissions by default, when it could be locked down to "rw-------" 600 permissions. This leads to...

Spotipy security vulnerability

Spotipy is the spotipy-dev individual developer's lightweight Python library for the Spotify Web API. A security vulnerability exists in Spotipy versions prior to 2.25.1, which stems from the CacheHandler class creating a cache file with overly lax permissions, which could lead to the disclosure ...

CVE-2025-27154: Incorrect Default Permissions

Spotipy is a lightweight Python library for the Spotify Web API. The CacheHandler class creates a cache file to store the auth token. Prior to version 2.25.1, the file created has rw-r--r-- 644 permissions by default, when it could be locked down to rw------- 600 permissions. This leads to overly...