CVE-2025-27154

Advisory

Affected versions of Spotify are vulnerable Incorrect Default Permissions. Cache file, containing spotify auth token, is created with overly broad permissions.

Affected package

Affected versions

Fixed versions

Vulnerability changelog

Added

- Added examples for audiobooks, shows and episodes methods to examples directory

Fixed

- Fixed scripts in examples directory that didn't run correctly
- Updated documentation for `Client.current_user_top_artists` to indicate maximum number of artists limit
- Set auth cache file permissions to `600`: https://github.com/spotipy-dev/spotipy/security/advisories/GHSA-pwhh-q4h6-w599

Changed

- Updated get_cached_token and save_token_to_cache methods to utilize Python's Context Management Protocol
- Added except clause to get_cached_token method to handle json decode errors
- Added warnings and updated docs due to Spotify's deprecation of HTTP and "localhost" redirect URIs
- Use newer string formatters (<https://pyformat.info>)
- Marked `recommendation_genre_seeds` as deprecated

Resources

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-27154