CVE-2025-27154 — Spotipy's cache file, containing spotify auth token, is created with overly broad permissions

Affected: spotipy-dev spotipy

Spotipy is a lightweight Python library for the Spotify Web API. The `CacheHandler` class creates a cache file to store the auth token. Prior to version 2.25.1, the file created has `rw-r--r--` (644) permissions by default, when it could be locked down to `rw-------` (600) permissions. This leads to overly broad exposure of the spotify auth token. If this token can be read by an attacker (another user on the machine, or a process running as another user), it can be used to perform administrative actions on the Spotify account, depending on the scope granted to the token. Version 2.25.1 tightens the cache file permissions.

GHSA-pwhh-q4h6-w599 — Spotipy's cache file, containing spotify auth token, is created with overly broad permissions

Affected: PyPI: spotipy

### Summary

The `CacheHandler` class creates a cache file to store the auth token here: https://github.com/spotipy-dev/spotipy/blob/master/spotipy/cache_handler.py#L93-L98

The file created has `rw-r--r--` (644) permissions by default, when it could be locked down to `rw-------` (600) permissions. I think `600` is a sensible default.

![image](https://github.com/user-attachments/assets/0b7ebbc1-a27a-4528-ab6a-135c7886766a)

### Details

This leads to overly broad exposure of the spotify auth token. If this token can be read by an attacker (another user on the machine, or a process running as another user), it can be used to perform administrative actions on the Spotify account, depending on the scope granted to the token.

### PoC

Run an application that uses spotipy with client creation like this:

```python from pathlib import Path import spotipy from os import getenv

def create_spotify_client(client_id: str, client_secret: str) -> spotipy.Spotify: """Create and return an authenticated Spotify client.

Args: client_id: Spotify API client ID client_secret: Spotify API client secret

Returns: An authenticated Spotify client instance """ cache_path = Path.home() / ".cache" / "spotify-backup/.auth_cache" cache_path.parent.mkdir(parents=True, exist_ok=True) cache_handler = spotipy.cache_handler.CacheFileHandler(cache_path=str(cache_path))

client = spotipy.Spotify( auth_manager=spotipy.oauth2.SpotifyOAuth(…

Most recent entries from all

CVE-2025-27154 — Spotipy's cache file, containing spotify auth token, is created with overly broad permissions

GHSA-pwhh-q4h6-w599 — Spotipy's cache file, containing spotify auth token, is created with overly broad permissions