Low severity3.6OSV Advisory· Published Nov 27, 2025· Updated Apr 15, 2026
CVE-2025-66040
CVE-2025-66040
Description
Spotipy is a Python library for the Spotify Web API. Prior to version 2.25.2, there is a cross-site scripting (XSS) vulnerability in the OAuth callback server that allows for JavaScript injection through the unsanitized error parameter. Attackers can execute arbitrary JavaScript in the user's browser during OAuth authentication. This issue has been patched in version 2.25.2.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
spotipyPyPI | < 2.25.2 | 2.25.2 |
Affected products
3- Range: 2.10.0, 2.11.0, 2.11.1, …
- ghsa-coords2 versions
< 2.25.2+ 1 more
- (no CPE)range: < 2.25.2
- (no CPE)range: < 2.25.2-1.1
Patches
Vulnerability mechanics
References
4News mentions
0No linked articles in our index yet.