Introduction
Attackers could have accessed sensitive diagnostic screens and customer data across Burger King, Popeyes, and Tim Hortons by exploiting a fundamental authentication flaw in Restaurant Brands International's assistant platform. The vulnerability is tracked as CVE-2025-62650 and scored 8.3 on the CVSS scale. It shows the real-world risk of a cloud-managed restaurant operations platform relying on client-side authentication.
About Restaurant Brands International (RBI): RBI is a major company in the global quick-service restaurant industry, operating over 32,000 locations in more than 120 countries under brands including Burger King, Popeyes, and Tim Hortons. Its technology platforms handle drive-thru ordering, employee management, analytics, and customer data at massive scale.
Technical Information
The diagnostic screens in the RBI assistant platform used client-side authentication. The check ran in JavaScript in the user's browser, and the password ("admin") was hardcoded directly in the HTML source. Anyone with basic technical skills could inspect or modify that client-side code and bypass the authentication controls entirely. Once they had the password or had bypassed the check, attackers could reach sensitive diagnostic interfaces intended only for authorized personnel.
A misconfiguration in AWS Cognito, which managed user authentication for the platform, made the problem worse. User self-signup was enabled, so anyone could create an account. One signup endpoint required email verification, but an alternative signup endpoint skipped that check and sent credentials in plain text. With an account, an attacker could authenticate and access a wide range of sensitive resources, including:
- Store management functions (add, remove, or modify franchise locations)
- Employee account data
- Drive-thru audio recordings containing customer information
- Store analytics and sales data
- File upload and notification systems
The flaw is classified under CWE-603 (Use of Client-Side Authentication), the weakness class for security-critical checks performed on the client instead of the server. It affected all three major RBI domains (bk.com, popeyes.com, timhortons.com) through at least 2025-09-06.
Affected Systems and Versions
- Restaurant Brands International (RBI) assistant platform through 2025-09-06
- Impacted brands: Burger King (bk.com), Popeyes (popeyes.com), Tim Hortons (timhortons.com)
- Vulnerable configuration: Diagnostic screens relying on client-side authentication, AWS Cognito user pools with public signup enabled
Vendor Security History
RBI has faced scrutiny before, over exposed credentials and over concerns about the maturity of its cloud and application security practices. In this incident, the company remediated the vulnerability within a day of responsible disclosure. However, RBI also tried to suppress public discussion of the issue with DMCA takedown notices, which drew criticism from the security community over its approach to vulnerability disclosure and transparency.
