Cross-Site Scripting Flaw in Spotipy Affects OAuth Authentication

CVE-2025-66040

What is CVE-2025-66040?

The Spotipy library, a popular Python interface for the Spotify Web API, contains a cross-site scripting vulnerability in its OAuth callback server. This issue arises from the unsanitized error parameter which can be exploited to inject malicious JavaScript code. If successfully executed, this could allow attackers to run arbitrary JavaScript within the context of the user's browser during the OAuth authentication process, potentially leading to unauthorized access or data theft. The vulnerability has been addressed in Spotipy version 2.25.2.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References