CVE-2025-66040CWE-79cross-site-scripting

CVE-2025-66040

Low · published November 27, 2025

CVSS v3.1

3.6

EPSS

Percentile

4.4

In the wild

Unconfirmed

What it is

Spotipy is a Python library for the Spotify Web API. Prior to version 2.25.2, there is a cross-site scripting (XSS) vulnerability in the OAuth callback server that allows for JavaScript injection through the unsanitized error parameter. Attackers can execute arbitrary JavaScript in the user's browser during OAuth authentication. This issue has been patched in version 2.25.2.

The record

Technical detail

CVSS v3.1: 3.6 · LOW
Vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N
CVSS v4.0: Not supplied
EPSS: 0.00156 · 4.4th percentile
Weakness: CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published: 2025-11-27T05:15Z

References (2)

https://github.com/spotipy-dev/spotipy/commit/880b92d7243dcf2b83bf31dc365a858d8b5e6767 · [email protected]https://github.com/spotipy-dev/spotipy/security/advisories/GHSA-r77h-rpp9-w2xm · [email protected]

EPSS history

Timeline

26 NOV 23:14Z
Spotipy has a XSS vulnerability in OAuth callback server
cvelistv5