CVE-2025-62645
CriticalCVSS 9.9Exploitation Probability (EPSS)
Elevated risk52th percentile - higher than 52% of all known CVEs
Summary
The Restaurant Brands International (RBI) assistant platform through 2025-09-06 allows a remote authenticated attacker to obtain a token with administrative privileges for the entire platform via the createToken GraphQL mutation.
Risk Assessment
An attacker can gain full control over the platform, potentially leading to data breaches and unauthorized actions.
Recommendation
Restrict access to the createToken mutation and implement additional authentication and authorization mechanisms.
Other vulnerabilities in RBI assistant platform
See all- CVE-2025-62650High
The Restaurant Brands International (RBI) assistant platform through 2025-09-06 relies on client-side authentication for use of the diagnostic screen.
- CVE-2025-62648Medium
The Restaurant Brands International (RBI) assistant platform through 2025-09-06 allows remote attackers to adjust Drive Thru speaker audio volume.
Original NVD description (English source)
The Restaurant Brands International (RBI) assistant platform through 2025-09-06 allows a remote authenticated attacker to obtain a token with administrative privileges for the entire platform via the createToken GraphQL mutation.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS