PT-2025-48750 · Unknown · Arcade-Mcp

Published 2025-12-02 · Updated 2025-12-03 · CVE-2025-66454

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Arcade MCP versions prior to 1.5.4

Description Arcade MCP’s HTTP server uses a hardcoded default worker secret (dev) that is not validated or overridden during server startup. This allows unauthenticated attackers who know the default key to forge valid JWTs, bypassing the FastAPI authentication layer. Successful exploitation grants remote access to all worker endpoints, including tool enumeration and tool invocation, without requiring credentials.

Recommendations Update to version 1.5.4 or later.

Exploit

Fix

Using Hardcoded Credentials

Weakness Enumeration

CWE-321

CWE-798

Related Identifiers

CVE-2025-66454

GHSA-G2JX-37X6-6438

Affected Products

Arcade-Mcp

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/66xxx/CVE-2025-66454.json · Exploit
• https://osv.dev/vulnerability/CVE-2025-66454 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-66454 · Security Note
• https://github.com/ArcadeAI/arcade-mcp/security/advisories/GHSA-g2jx-37x6-6438 · Note
• https://github.com/ArcadeAI/arcade-mcp/pull/691 · Note
• https://github.com/ArcadeAI/arcade-mcp/commit/44660d18ceb220600401303df860a31ca766c817 · Note
• https://t.me/CVEtracker/38709 · Telegram Post
• https://twitter.com/CVEnew/status/1995929994699157894 · Twitter Post
• https://reddit.com/r/VulnMatter/comments/1pchx5n/resumen_diario_de_vulnerabilidades_02122025 · Reddit Post
• https://twitter.com/VulmonFeeds/status/1996129273095070081 · Twitter Post