Does this mean that the secondary damage from GFB can be used to circumvent a target's AC and save mechanics?
Yes. If you successfully hit the first creature, the second creature's AC and Dex doesn't matter.
How is it possible that this loophole was ever allowed?
Not a loophole, it is how the spell works.
Is this comparable to other attack mechanics or is it overpowered?
This is a matter of opinion, but no.
We're talking about an amount of damage equal to spell casting attribute mod. Using standard array or point buy the max is a +3 at level 1, and gets up to a +5 when you max the stat out at 20 (can be higher with magic items, etc.) but we're not talking a lot damage here. Moreover it is fire damage which is (one of) the most common type of resistance/immunities.
Since you use "Cast a Spell" action to use this feature, you can't use dual wielding rules to make a second attack that action. Meaning you are likely giving up a strike with a second light weapon by casting this spell.
Compare it to Eldritch Blast, also a cantrip, which gets up to 4 beams each doing 1d10 (+CHA Modifier each with agonizing blast, each pushing 10 feet with repelling blast, etc.). Eldritch Blast is also Force damage, so it touches the Ethereal and resistence and immunity to it are rare. It is clear that Green Flame Blade isn't even the strongest cantrip.