Spotipy hat eine XSS-Schwachstelle in seinem OAuth-Callback-Server

The primary impact of this XSS vulnerability is the potential for attackers to execute arbitrary JavaScript code within the context of a user's browser session. This could lead to various malicious actions, including session hijacking, credential theft, redirection to phishing sites, and defacement of the user interface. An attacker could leverage this vulnerability to gain unauthorized access to sensitive user data or compromise the user's account. The scope of the impact depends on the privileges associated with the affected user account and the sensitivity of the data accessed through the spotipy application.

Applications and services that rely on spotipy for OAuth authentication are at risk. This includes developers integrating spotipy into their projects and users who authenticate with applications using spotipy. Shared hosting environments where multiple applications share the same spotipy installation are particularly vulnerable.

• python / spotipy: Inspect OAuth callback handling code (spotipy/oauth2.py) for unsanitized error parameter usage. • generic web: Monitor access logs for requests containing suspicious characters in the 'error' parameter of OAuth callback URLs. • generic web: Use a WAF to block requests containing JavaScript code in the 'error' parameter of OAuth callback URLs.

grep -i 'error=.*<script>' /var/log/apache2/access.log

1. 2025-12-01Disclosure

   disclosure

1. Reserviert2025-11-21
2. Veröffentlicht2025-12-01
3. EPSS aktualisiert2026-03-23

The recommended mitigation for CVE-2025-66040 is to immediately upgrade to spotipy version 2.25.2 or later. This version includes a fix that properly sanitizes the 'error' parameter, preventing the XSS vulnerability. If upgrading is not immediately feasible, consider implementing a Web Application Firewall (WAF) rule to filter out potentially malicious characters from the 'error' parameter in OAuth callbacks. Additionally, carefully review and sanitize any user-supplied input used in HTML generation to prevent similar vulnerabilities. After upgrading, confirm the fix by attempting to trigger the OAuth flow with a crafted 'error' parameter containing JavaScript code; it should be properly escaped and not executed.