CVE-2025-27154: 
Python vulnerability analysis and mitigation

Spotipy, a lightweight Python library for the Spotify Web API, was found to have a security vulnerability (CVE-2025-27154) in versions prior to 2.25.1. The vulnerability stems from the CacheHandler class creating a cache file to store authentication tokens with overly permissive file permissions (644 or rw-r--r--) instead of more restrictive permissions (600 or rw-------). This vulnerability was discovered and disclosed on February 27, 2025, affecting all versions of Spotipy up to version 2.25.0 (GitHub Advisory, NVD).

The vulnerability exists in the CacheHandler class implementation where the cache file storing Spotify authentication tokens is created with default permissions of 644 (rw-r--r--). These permissions allow the file to be readable by other users on the same system, potentially exposing sensitive authentication tokens. The vulnerability has been assigned a CVSS v4.0 base score of 8.4 (High), with the vector string CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N. The issue is classified as CWE-276 (Incorrect Default Permissions) (GitHub Advisory).

The vulnerability's impact is significant as it could lead to unauthorized access to users' Spotify accounts. If an attacker gains access to the authentication token, they could perform administrative actions on the Spotify account depending on the scope granted to the token. Potential malicious actions include exfiltrating spotify likes and saved playlists, deleting content, or modifying content without permission. The impact is particularly severe in multi-user environments or systems where the home directory has broad read permissions (Security Online, GitHub Advisory).

The vulnerability requires local access to the affected system and can be exploited by another user on the machine or a process running as another user. The exploitation is straightforward and requires no special conditions beyond the ability to read files with world-readable permissions. The vulnerability is particularly exploitable when combined with other misconfigurations, such as having o+r permissions set on the user's home directory (GitHub Advisory).

The vulnerability has been patched in Spotipy version 2.25.1, which changes the default cache file permissions to 600 (rw-------). Users are strongly encouraged to upgrade to this version, especially if running Spotipy in a multi-user environment or managing multiple users' auth tokens. The fix involves adding an explicit os.chmod() call to set the file permissions to 0o600 after creating the cache file (GitHub Release, GitHub Commit).