CVE-2025-62650
BaseFortify
Publication date: 2025-10-17
Last updated on: 2025-10-31
Assigner: MITRE
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| rbi | restaurant_brands_international_assistant | to 2025-09-06 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-603 | A client/server product performs authentication within client code but not in server code, allowing server-side authentication to be bypassed via a modified client that omits the authentication check. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the Restaurant Brands International (RBI) assistant platform up to version 2025-09-06, where it relies on client-side authentication for accessing the diagnostic screen. This means that the authentication process is handled on the user's device rather than securely on the server, potentially allowing unauthorized users to bypass authentication controls.
How can this vulnerability impact me? :
Because the platform relies on client-side authentication for the diagnostic screen, an attacker could exploit this to gain unauthorized access, leading to potential information disclosure, modification, or disruption of service. The CVSS score indicates a high severity with impacts on confidentiality, integrity, and availability.