CVE-2025-66454

Katalog CVE

CVSS 6.5 · Medium EPSS 0,31%

Kerentanan Use of Hard-coded Cryptographic Key. Skor CVSS 3.1 6.5 (Medium) menurut github.com.

Deskripsi (NVD)

Arcade MCP allows you to to create, deploy, and share MCP Servers. Prior to 1.5.4, the arcade-mcp HTTP server uses a hardcoded default worker secret ("dev") that is never validated or overridden during normal server startup. As a result, any unauthenticated attacker who knows this default key can forge valid JWTs and fully bypass the FastAPI authentication layer. This grants remote access to all worker endpoints—including tool enumeration and tool invocation—without credentials. This vulnerability is fixed in 1.5.4.

Rincian

Terbit di NVD

2 Desember 2025

Terakhir diubah

17 Juni 2026

Status NVD

Deferred

CVSS 3.1

6.5 (Medium), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-321: Use of Hard-coded Cryptographic Key
CWE-798: Use of Hard-coded Credentials

EPSS (30 hari)

0,31% peluang dieksploitasi; lebih tinggi dari 22,4% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://github.com/ArcadeAI/arcade-mcp/commit/44660d18ceb220600401303df860a31ca766c817
• https://github.com/ArcadeAI/arcade-mcp/pull/691
• https://github.com/ArcadeAI/arcade-mcp/security/advisories/GHSA-g2jx-37x6-6438