Back in 2020, a researcher reported a flaw to Spotify:
Their Accesspoint API lets anyone with a valid account download and decrypt song data without any DRM or device attestation
Fast forward to 2023, I independently discovered and reported the same issue to their Hackerone program.
They dismissed it and didn't take any action for more than 5 years to address or fix the issue.
After exhausting all responsible disclosure options, I feel obligated to make this information public in the hope that it will finally prompt Spotify to take action and implement proper security measures.