Medium severity6.5OSV Advisory· Published Dec 2, 2025· Updated Apr 15, 2026
CVE-2025-66454
CVE-2025-66454
Description
Arcade MCP allows you to to create, deploy, and share MCP Servers. Prior to 1.5.4, the arcade-mcp HTTP server uses a hardcoded default worker secret ("dev") that is never validated or overridden during normal server startup. As a result, any unauthenticated attacker who knows this default key can forge valid JWTs and fully bypass the FastAPI authentication layer. This grants remote access to all worker endpoints—including tool enumeration and tool invocation—without credentials. This vulnerability is fixed in 1.5.4.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
arcade-mcp-serverPyPI | < 1.9.1 | 1.9.1 |
Affected products
2- Range: 0.0.10, 0.0.11, 0.0.12, …
Patches
Vulnerability mechanics
References
6- github.com/advisories/GHSA-g2jx-37x6-6438ghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2025-66454ghsaADVISORY
- github.com/ArcadeAI/arcade-mcp/commit/44660d18ceb220600401303df860a31ca766c817nvdWEB
- github.com/ArcadeAI/arcade-mcp/commit/7fb097f20fbea35e382a1b78da6fd90609c55a9eghsaWEB
- github.com/ArcadeAI/arcade-mcp/pull/691nvdWEB
- github.com/ArcadeAI/arcade-mcp/security/advisories/GHSA-g2jx-37x6-6438nvdWEB
News mentions
0No linked articles in our index yet.