AIKIDO-2025-10119

TL;DR

Affected versions of this package set incorrect default permissions for the cache file created by the CacheHandler class to store the Spotify auth token. The file is created with rw-r--r-- (644) permissions instead of the more secure rw------- (600). This misconfiguration allows other users or processes on the machine to read the token, potentially exposing it to unauthorized access. If an attacker gains access to the token, they could use it to perform administrative actions on the associated Spotify account, depending on the granted scopes.