VDB
CVE-2025-66040
CVE-2025-66040
PUBLISHED
CVSS 3.6 LOW
Spotipy has a XSS vulnerability in OAuth callback server
Reported by github_m · Published November 26, 2025
Spotipy is a Python library for the Spotify Web API. Prior to version 2.25.2, there is a cross-site scripting (XSS) vulnerability in the OAuth callback server that allows for JavaScript injection through the unsanitized error parameter. Attackers can execute arbitrary JavaScript in the user's browser during OAuth authentication. This issue has been patched in version 2.25.2.
Risk scores
CVSS 3.1
3.6
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N
Affected products
| Vendor | Product | Versions |
|---|---|---|
| spotipy-dev | spotipy | < 2.25.2 |
| PyPI | spotipy | 0 |
| spotipy-dev | spotipy | 0 |
Timeline
- Nov 26, 2025 CVE Published
- Nov 27, 2025 EPSS Score (30 in total, the first dated here)
- Nov 27, 2025 Coalition ESS Score (5 in total, the first dated here)
- Nov 27, 2025 PoC Published
- Dec 7, 2025 Security Advisory
- Jul 7, 2026 CVE Updated
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln CVE-2025-66040
vulnetix vdb fixes CVE-2025-66040Or with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/CVE-2025-66040/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart
References
- https://github.com/spotipy-dev/spotipy/security/advisories/GHSA-r77h-rpp9-w2xm x_refsource_CONFIRM
- https://github.com/spotipy-dev/spotipy/commit/880b92d7243dcf2b83bf31dc365a858d8b5e6767 x_refsource_MISC
- https://nvd.nist.gov/vuln/detail/CVE-2025-66040 advisory
- https://github.com/advisories/GHSA-r77h-rpp9-w2xm advisory
- https://github.com/spotipy-dev/spotipy url