CVE-2025-62645: Privilege Escalation in Restaurant Brands International Assistant Platform (Brief Summary)

Introduction

A single GraphQL mutation could give attackers administrative access to the core management systems of Burger King, Tim Hortons, and Popeyes. Over 30,000 restaurant locations were exposed to potential compromise of their employee data, drive-thru audio, and operational controls. This post summarizes CVE-2025-62645, a critical vulnerability in Restaurant Brands International's assistant platform with a CVSS score of 9.9.

About Restaurant Brands International (RBI): RBI is a global quick-service restaurant company that operates Burger King, Tim Hortons, Popeyes, and Firehouse Subs. It has over 32,000 locations in 120+ countries, and its platforms process millions of transactions and hold large amounts of employee and customer data. A security failure in those platforms has global reach.

Technical Information

The vulnerability in the RBI assistant platform comes from several authentication and authorization failures combined:

• AWS Cognito Misconfiguration: User registration was never disabled, so anyone could create an account without administrative approval. This widened the attack surface for no good reason.
• Email Verification Bypass: An alternative registration endpoint let attackers skip email verification, and it sent credentials in plaintext to unverified addresses.
• GraphQL Introspection Enabled: Attackers could enumerate the entire API schema, including its sensitive operations.
• createToken Mutation: The GraphQL mutation createToken accepted parameters that allowed privilege escalation. It had no authorization checks, so any authenticated user could request an administrative token.
• Hardcoded and Default Credentials: Passwords were hardcoded in HTML, and drive-thru tablets used the default password 'admin'.

Exploitation Flow:

1. Register a user account through the open Cognito endpoint or the email verification bypass.
2. Use GraphQL introspection to find the createToken mutation and its parameters.
3. Authenticate and call createToken, requesting administrative privileges.
4. Use the returned token for unrestricted access to employee data, drive-thru audio, store management, and equipment ordering across all RBI brands.

Root Cause:

• User registration in AWS Cognito was left unrestricted.
• Email verification was not enforced.
• GraphQL introspection was exposed in production.
• The createToken mutation had no authorization logic.
• Credentials were poorly managed, with hardcoded and default passwords.

No public code snippets are available. All technical details here come from public disclosures and archived research.

Affected Systems and Versions

• Products: RBI assistant platform for Burger King, Tim Hortons, and Popeyes
• Version: All versions through 2025-09-06
• Vulnerable Configurations:
  • AWS Cognito with public user registration enabled
  • GraphQL API with introspection enabled
  • createToken mutation lacking authorization checks
  • Email verification not enforced
  • Hardcoded or default credentials present

Vendor Security History

• RBI has had earlier problems with exposed credentials and configuration weaknesses (see the Cybernews 2023 report).
• The company fixed this vulnerability within a day of disclosure, but it answered the researchers with legal threats and gave them no public recognition.
• Repeated basic security failures and a negative response to responsible disclosure raise questions about RBI's security maturity.

References

• NVD Entry for CVE-2025-62645
• BobDaHacker Blog (archived)
• Malwarebytes Analysis
• Security Magazine Discussion
• Tom's Hardware Coverage
• Techzine Report
• CWE-266: Incorrect Privilege Assignment