arcade-mcp (>=1.0.0rc1, <=1.0.0rc4) potentially affected by CVE-2025-66454 via arcade-mcp-server (1.0.0rc3)

arcade-mcp-server PYPI version 1.0.0rc3 is affected by a known vulnerability. The following packages have a transitive dependency on arcade-mcp-server and may be impacted: - arcade-mcp =1.0.0rc1, =1.0.0rc4 Source cves: CVE-2025-66454 Source advisory: OSV:PYSEC-2026-1192...

Use of Hard-coded Cryptographic Key

Overview arcade-mcp-server is a Model Context Protocol MCP server framework for Arcade.dev Affected versions of this package are vulnerable to Use of Hard-coded Cryptographic Key via the HTTP server uses a hardcoded default worker secret "dev" that is never validated or overridden during normal...

arcade-mcp (>=1.0.0rc1, <=1.0.0rc4) potentially affected by CVE-2025-66454 via arcade-mcp-server (1.0.0rc3)

arcade-mcp-server PYPI version 1.0.0rc3 is affected by a known vulnerability. The following packages have a transitive dependency on arcade-mcp-server and may be impacted: - arcade-mcp =1.0.0rc1, =1.0.0rc4 Source cves: CVE-2025-66454 Source advisory: SNYK:PYTHON-ARCADEMCPSERVER-14171924...

arcade-mcp (>=1.0.0rc1, <=1.0.0rc4) potentially affected by CVE-2025-66454 via arcade-mcp-server (1.0.0rc3)

arcade-mcp-server PYPI version 1.0.0rc3 is affected by a known vulnerability. The following packages have a transitive dependency on arcade-mcp-server and may be impacted: - arcade-mcp =1.0.0rc1, =1.0.0rc4 Source cves: CVE-2025-66454 Source advisory: MEND:CVE-2025-66454...

EUVD-2025-200280

arcade-mcp-server Has Default Hardcoded Worker Secret That Allows Full Unauthorized Access to All HTTP MCP Worker Endpoints...

GHSA-G2JX-37X6-6438 arcade-mcp-server Has Default Hardcoded Worker Secret That Allows Full Unauthorized Access to All HTTP MCP Worker Endpoints

Summary The arcade-mcp HTTP server uses a hardcoded default worker secret "dev" that is never validated or overridden during normal server startup. As a result, any unauthenticated attacker who knows this default key can forge valid JWTs and fully bypass the FastAPI authentication layer. This...

arcade-mcp (>=1.0.0rc1, <=1.0.0rc4) potentially affected by CVE-2025-66454 via arcade-mcp-server (1.0.0rc3)

arcade-mcp-server PYPI version 1.0.0rc3 is affected by a known vulnerability. The following packages have a transitive dependency on arcade-mcp-server and may be impacted: - arcade-mcp =1.0.0rc1, =1.0.0rc4 Source cves: CVE-2025-66454 Source advisory: OSV:GHSA-G2JX-37X6-6438...

arcade-mcp (>=1.0.0rc1, <=1.0.0rc4) potentially affected by CVE-2025-66454 via arcade-mcp-server (1.0.0rc3)

arcade-mcp-server PYPI version 1.0.0rc3 is affected by a known vulnerability. The following packages have a transitive dependency on arcade-mcp-server and may be impacted: - arcade-mcp =1.0.0rc1, =1.0.0rc4 Source cves: CVE-2025-66454 Source advisory: GHSA-G2JX-37X6-6438...