XSS Vulnerability in OAuth Callback Server Summary Affected Package: Affected Versions: Patched Version: CVE ID: Severity: (Low) Key Information Description The OAuth callback server in spotipy has an XSS vulnerability due to unsanitized error parameter. Attackers can execute arbitrary JavaScript in the user's browser. Vulnerable Code Attack Flow 1. User starts OAuth authentication. 2. Attacker crafts a malicious URL: . 3. User visits URL → JavaScript executes locally. Proof of Concept A Python script demonstrates the XSS vulnerability: Fix Impact Vulnerability Type: XSS - CWE-79 Affected Users: Anyone using spotipy's OAuth flow with localhost redirect URIs. Attack Complexity: Medium-High Potential Impact: Execution of JavaScript, access to localhost, stealing data, etc. CVSS 3.1 Score: 4.2 (Medium)