CVE-2025-62647

MEDIUM 5.8CVE-2025-62647 · Published 17/10/2025 · updated 08/10/2026

In short

CVE-2025-62647 is a MEDIUM (CVSS 5.8) vulnerability affecting restaurant brands international assistant (rbi).
Chance of exploitation in the next 30 days (EPSS): 0.38%, higher than 31.6% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
restaurant brands international assistant rbi	`≤ 2025-09-06`	No fix yet

Description

The Restaurant Brands International (RBI) assistant platform through 2025-09-06 provides the functionality of returning a JWT that can be used to call an API to return a signed AWS upload URL, for any store's path.

References

archive.today/fMYQp · Exploit
bobdahacker.com/blog/rbi-hacked-drive-thrus · Permissions Required
web.archive.org/web/20250906134240/https:/bobdahacker.com/blog/rbi-hacked-drive-thrus · Not Applicable
malwarebytes.com/blog/news/2025/09/popeyes-tim-hortons-burger-king-platforms-have-catastrophic-vulnerabilities-say-hackers · Press/Media Coverage
yahoo.com/news/articles/burger-king-hacked-attackers-impressed-124154038.html · Press/Media Coverage

More vulnerabilities in restaurant brands international assistant

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

restaurant brands international assistant

rbi

≤ 2025-09-06

No fix yet

More vulnerabilities in restaurant brands international assistant

See all →