CVE-2025-62647

The Restaurant Brands International RBI assistant platform through 2025-09-06 provides the functionality of returning a JWT that can be used to call an API to return a signed AWS upload URL, for any store's path...

CVE-2025-62650: Use of Client-Side Authentication

The Restaurant Brands International RBI assistant platform through 2025-09-06 relies on client-side authentication for use of the diagnostic screen...

PT-2025-42660

Name of the Vulnerable Software and Affected Versions Restaurant Brands International RBI assistant platform versions through 2025-09-06 Description The Restaurant Brands International RBI assistant platform through 2025-09-06 allows obtaining a JWT JSON Web Token which can be used to call an API...

PT-2025-42657

Name of the Vulnerable Software and Affected Versions Restaurant Brands International RBI assistant platform versions through 2025-09-06 Description The Restaurant Brands International RBI assistant platform’s Global Store Directory shares personal information among authenticated users...

PT-2025-42662

Name of the Vulnerable Software and Affected Versions Restaurant Brands International RBI assistant platform versions through 2025-09-06 Description The Restaurant Brands International RBI assistant platform through 2025-09-06 utilizes client-side authentication when submitting equipment orders...

PT-2025-42663

Name of the Vulnerable Software and Affected Versions Restaurant Brands International RBI assistant platform versions through 2025-09-06 Description The Restaurant Brands International RBI assistant platform has a client-side authentication flaw that allows attackers to bypass access controls for...

PT-2025-42659

Name of the Vulnerable Software and Affected Versions Restaurant Brands International RBI assistant platform versions through 2025-09-06 Description The RBI assistant platform allows remote attackers to review stored audio recordings of conversations between associates and Drive Thru customers...

PT-2025-42656

Name of the Vulnerable Software and Affected Versions Restaurant Brands International RBI assistant platform versions prior to 2025-09-07 Description The Restaurant Brands International RBI assistant platform transmits user account passwords in cleartext email messages. Recommendations Update the...

CVE-2025-62645: Incorrect Privilege Assignment

The Restaurant Brands International RBI assistant platform through 2025-09-06 allows a remote authenticated attacker to obtain a token with administrative privileges for the entire platform via the createToken GraphQL mutation...

CVE-2025-62651: Incorrect Authorization

The Restaurant Brands International RBI assistant platform through 2025-09-06 does not implement access control for the bathroom rating interface...

PT-2025-42664

Name of the Vulnerable Software and Affected Versions Restaurant Brands International RBI assistant platform versions through 2025-09-06 Description The software does not implement access control for the bathroom rating interface. Recommendations Implement access control for the bathroom rating...

CVE-2025-62646

The Restaurant Brands International RBI assistant platform through 2025-09-06 allows remote attackers to review the stored audio of conversations between associates and Drive Thru customers...