CVE-2025-62649
BaseFortify
Publication date: 2025-10-17
Last updated on: 2025-11-06
Assigner: MITRE
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| rbi | restaurant_brands_international_assistant | to 2025-09-06 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-603 | A client/server product performs authentication within client code but not in server code, allowing server-side authentication to be bypassed via a modified client that omits the authentication check. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the Restaurant Brands International (RBI) assistant platform, which relies on client-side authentication for submitting equipment orders. This means that the authentication process is handled on the user's device rather than securely on the server, potentially allowing attackers to bypass authentication controls and submit unauthorized orders.
How can this vulnerability impact me? :
The vulnerability can allow unauthorized users to submit equipment orders through the RBI assistant platform, potentially leading to fraudulent orders or misuse of resources. Since the integrity of order submissions can be compromised, it may result in financial loss or operational disruptions.