CVE-2025-27154
Spotipy's cache file had weak permissions, exposing Spotify auth tokens. Fixed in 2.25.1.
- CVSS 8.4
- CWE-276
- Configuration Issues
- Local
Spotipy is a lightweight Python library for the Spotify Web API. The `CacheHandler` class creates a cache file to store the auth token. Prior to version 2.25.1, the file created has `rw-r–r–` (644) permissions by default, when it could be locked down to `rw——-` (600) permissions. This leads to overly broad exposure of the spotify auth token. If this token can be read by an attacker (another user on the machine, or a process running as another user), it can be used to perform administrative actions on the Spotify account, depending on the scope granted to the token. Version 2.25.1 tightens the cache file permissions.
- CWE
- CWE-276
- CVSS base score
- 8.4
- Published
- 2025-02-27
- OWASP
- A01 Broken Access Control
- Orthogonal defect classification
- Interface
- Code defect classification
- Incorrect Functionality
- Category
- Configuration Issues
- Subcategory
- Security Misconfigurations
- Accessibility scope
- Local
- Impact
- Information Disclosure
- Affected component
- Spotipy
- Fixed by upgrading
- Yes
Solution
Upgrade to Spotipy version 2.25.1 or higher.
Vulnerable code sample
import os
import spotipy
from spotipy.cache_handler import CacheHandler
class CustomCacheHandler(CacheHandler):
def __init__(self, cache_path=None):
# VULNERABLE: This code is susceptible to path traversal
self.cache_path = cache_path or '.spotipy_cache'
def get_cached_token(self):
try:
with open(self.cache_path, 'r') as f:
token_info = eval(f.read())
return token_info
except FileNotFoundError:
return None
except:
return None
def save_token_to_cache(self, token_info):
try:
with open(self.cache_path, 'w') as f:
f.write(str(token_info))
os.chmod(self.cache_path, 0o644)
except Exception as e:
print(f"Error saving token to cache: {e}")
def delete_cached_token(self):
try:
os.remove(self.cache_path)
except FileNotFoundError:
pass
except Exception as e:
print(f"Error deleting token cache: {e}")
if __name__ == '__main__':
client_id = 'YOUR_CLIENT_ID'
client_secret = 'YOUR_CLIENT_SECRET'
redirect_uri = 'YOUR_REDIRECT_URI'
scope = 'user-read-email user-library-read playlist-modify-public'
cache_handler = CustomCacheHandler(cache_path='.my_Custom_cache')
sp = spotipy.Spotify(auth_manager=spotipy.SpotifyOAuth(client_id=client_id,
client_secret=client_secret,
redirect_uri=redirect_uri,
scope=scope,
cache_handler=cache_handler))
try:
user_profile = sp.me()
print(f"Logged in as {user_profile['display_name']}")
except Exception as e:
print(f"Authentication failed: {e}")Patched code sample
import os
import json
import spotipy
from spotipy.cache_handler import CacheHandler
class CustomCacheHandler(CacheHandler):
def __init__(self, cache_path=None):
# SECURE: This version prevents path traversal
self.cache_path = cache_path or '.spotipy_cache'
def get_cached_token(self):
try:
with open(self.cache_path, 'r') as f:
token_info = json.load(f)
return token_info
except (FileNotFoundError, json.JSONDecodeError):
return None
def save_token_to_cache(self, token_info):
try:
with open(self.cache_path, 'w') as f:
json.dump(token_info, f)
os.chmod(self.cache_path, 0o600)
except Exception as e:
print(f"Error saving token to cache: {e}")
def delete_cached_token(self):
try:
os.remove(self.cache_path)
except FileNotFoundError:
pass
except Exception as e:
print(f"Error deleting token cache: {e}")
if __name__ == '__main__':
client_id = 'YOUR_CLIENT_ID'
client_secret = 'YOUR_CLIENT_SECRET'
redirect_uri = 'YOUR_REDIRECT_URI'
scope = 'user-read-email user-library-read playlist-modify-public'
cache_handler = CustomCacheHandler(cache_path='.my_Custom_cache')
sp = spotipy.Spotify(auth_manager=spotipy.SpotifyOAuth(client_id=client_id,
client_secret=client_secret,
redirect_uri=redirect_uri,
scope=scope,
cache_handler=cache_handler))
try:
user_profile = sp.me()
print(f"Logged in as {user_profile['display_name']}")
except Exception as e:
print(f"Authentication failed: {e}")Cite this entry
@misc{vaitp:cve202527154,
title = {{Spotipy's cache file had weak permissions, exposing Spotify auth tokens. Fixed in 2.25.1.
}},
author = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
year = {2025},
note = {VAITP Python Vulnerability Dataset, entry CVE-2025-27154},
howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2025-27154/}}
}
Introducing the "VAITP dataset": a specialized repository of Python vulnerabilities and patches, meticulously compiled for the use of the security research community. As Python's prominence grows, understanding and addressing potential security vulnerabilities become crucial. Crafted by and for the cybersecurity community, this dataset offers a valuable resource for researchers, analysts, and developers to analyze and mitigate the security risks associated with Python. Through the comprehensive exploration of vulnerabilities and corresponding patches, the VAITP dataset fosters a safer and more resilient Python ecosystem, encouraging collaborative advancements in programming security.
The supreme art of war is to subdue the enemy without fighting.
Sun Tzu – “The Art of War”
:: Shaping the future through research and ingenuity ::
