Executive brief
Spotipy's cache file, containing spotify auth token, is created with overly broad permissions
Affected products
- PyPI spotipy
Junglewise Threat Intelligence
CVE-2025-27154: PYSEC-2026-1936 - Spotipy's cache file, containing spotify auth token, is created with overly broad permissions
CVE-2025-27154 · Severity: medium · CVSS 4 · Published 2026-07-07
Technologies: spotipy (PyPI). Vendors: PyPI.