The way auth tokens are setup for Mopidy-Spotify you hold the encryption key for the blob with the OAuth data, and the intermediate server just has an id and the encrypted data. Note that the id is not a Spotify OAuth client-id but an internal one. This is done so we don't have to ship Mopidy-Spotify with the client-secret for the App registration (this was pre PKCE auth).

I.e. I would be highly surprised if our OAuth integration was the source for this issue, but I'm obviously biased as the author of https://github.com/adamcik/oauthclientbridge

As for libspotify, there you had to put in a (device) password and username, so if something scraped that config I guess all bets are off...

This happened to me using the official client. All was well after password change.

Turns out, spotify gets their data breached regularly and I'm assuming that's the case here.

It happened to me and my brother too (in separate occasions), with the official client.

The data and music "being played" with our accounts seemed so random and niche that I doubt that it was result of human interaction, seemed like something wrong with their DB. Also, changing the password didn't fix it.

Had to change the password and also delete all the data in the account, losing also my data of course. It had so much garbage that it was pretty much ruined anyway