2025 Arcade AI — CVE-2025-66454 hardcoded JWT secret, auth bypass

2025 Unknown records affected

Data compromised

Potential: full endpoint access; tool invocation

Technical writeup

CVE-2025-66454: arcade-mcp HTTP server (versions before 1.5.4) used hardcoded default worker secret key 'dev' never validated at startup. Unauthenticated attackers could forge valid JWT tokens and bypass FastAPI authentication. Full remote access to worker endpoints, tool enumeration and invocation. Fixed in 1.5.4.

Root cause

Hardcoded default secret; no validation

References

https://nvd.nist.gov/vuln/detail/CVE-2025-66454