Spotipy has a XSS vulnerability in its OAuth callback server
Date: 2025-12
Affected: pip/spotipy
Attack vector: xss
Category: vulnerability-disclosure
Severity: Low
CVE: CVE-2025-66040
CWE: CWE-79
CVSS: 3.6 (CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N)

### Summary XSS vulnerability in OAuth callback server allows JavaScript injection through unsanitized error parameter. Attackers can execute arbitrary JavaScript in the user's browser during OAuth authentication. ### Details **Vulnerable Code:** `spotipy/oauth2.py` lines 1238-1274 (RequestHandler.do_GET) **The Problem:** During OAuth flow, spotipy starts a local HTTP server to receive callbacks. The server reflects the `error` URL parameter directly into HTML without sanitization. **Vulnerable code at line 1255:** ```python status = f"failed ({self.server.error})" ``` **Then embedded in HTML at line 1265:** ```python self._write(f"""<html> <body> <h1>Authentication status: {status}</h1> </body> </html>""") ``` The `error` parameter comes from URL parsing (lines 388-393) without HTML escaping, allowing script injection. **Attack Flow:** 1. User starts OAuth authentication → local server runs on `http://127.0.0.1:8080` 2. Attacker crafts malicious URL: `http://127.0.0.1:8080/?error=<script>alert(1)</script>&state=x` 3. User visits URL → JavaScript executes in localhost origin ### PoC **Simple Python Test:** ```python #!/usr/bin/env python3 # poc_xss.py - Demonstrates XSS in spotipy OAuth callback import requests from spotipy.oauth2 import start_local_http_server import threading import time # Start vulnerable server in background def start_server(): server = start_local_http_server(8080) server.handle_request() thread = threading.Thread(target=start_server


Mitigations:

Architectural layers (MAESTRO):