CVE-2023-23608

Spotipy is a light weight Python library for the Spotify Web API. In versions prior to 2.22.1, if a malicious URI is passed to the library, the library can be tricked into performing an operation on a different API endpoint than intended. The code Spotipy uses to parse URIs and URLs allows an attacker to insert arbitrary characters into the path that is used for API requests. Because it is possible to include "..", an attacker can redirect for example a track lookup via spotifyApi.track() to an arbitrary API endpoint like playlists, but this is possible for other endpoints as well. The impact of this vulnerability depends heavily on what operations a client application performs when it handles a URI from a user and how it uses the responses it receives from the API. This issue is patched in version 2.22.1.

• CWE-22
• CWE-22

• https://github.com/spotipy-dev/spotipy/security/advisories/GHSA-q764-g6fm-555vExploit, Patch, Third Party Advisory
• https://github.com/spotipy-dev/spotipy/security/advisories/GHSA-q764-g6fm-555vExploit, Patch, Third Party Advisory

Published

Jan 26, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-23602A mishandled security check when creating a WebSocket in a W…6.5
• CVE-2023-23603Regular expressions used to filter out forbidden properties …6.5
• CVE-2023-23604A duplicate `SystemPrincipal` object could be created when p…6.5
• CVE-2023-23605Mozilla developers and the Mozilla Fuzzing Team reported mem…8.8
• CVE-2023-23606Mozilla developers and the Mozilla Fuzzing Team reported mem…8.8
• CVE-2023-23607erohtar/Dasherr is a dashboard for self-hosted services. In …9.8
• CVE-2023-23609Contiki-NG is an open-source, cross-platform operating syste…7.4
• CVE-2023-2361Cross-site Scripting (XSS) - Stored in GitHub repository pim…5.4
• CVE-2023-23610GLPI is a Free Asset and IT Management Software package. Ver…6.5
• CVE-2023-23611LTI Consumer XBlock implements the consumer side of the LTI …5.4
• CVE-2023-23612OpenSearch is an open source distributed and RESTful search …8.8
• CVE-2023-23613OpenSearch is an open source distributed and RESTful search …6.5