CVE-2025-66040 Spotipy has a XSS vulnerability in OAuth callback server
Attackers can execute arbitrary JavaScript in users' browsers via unsanitized error parameters in the Spotipy OAuth callback server.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2025-66040?
CVE-2025-66040 is a low-severity cross-site scripting vulnerability in spotipy-dev spotipy, published on 26 Nov 2025. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
Spotipy is a Python library for the Spotify Web API. Prior to version 2.25.2, there is a cross-site scripting (XSS) vulnerability in the OAuth callback server that allows for JavaScript injection through the unsanitized error parameter. Attackers can execute arbitrary JavaScript in the user's browser during OAuth authentication. This issue has been patched in version 2.25.2.
Weakness: CWE-79
Which versions are affected by CVE-2025-66040?
3 open source packages ship an affected version, including spotipy.
| Package | Affected | Fixed in |
|---|---|---|
spotipy PyPI | All versions | 2.25.2 |
spotipy PyPI | All versions | 2.25.2 |
spotipy PyPI | All versions | 2.25.2 |
Linux distribution packages (1)
python-spotipy openSUSE:Tumbleweed | All versions | 2.25.2-1.1 |
How do I fix CVE-2025-66040?
Upgrade spotipy to 2.25.2 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2025-66040 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-66040 exists.
Sources
Also known as DEBIAN-CVE-2025-66040, GHSA-r77h-rpp9-w2xm, PYSEC-2026-1937, UBUNTU-CVE-2025-66040, openSUSE-SU-2025:15777-1.