Executive brief
Spotipy has a XSS vulnerability in its OAuth callback server
Affected products
- PyPI spotipy
Junglewise Threat Intelligence
CVE-2025-66040: PYSEC-2026-1937 - Spotipy has a XSS vulnerability in its OAuth callback server
CVE-2025-66040 · Severity: low · CVSS 3.1 · Published 2026-07-07
Technologies: spotipy (PyPI). Vendors: PyPI.