CVE-2025-62649: medium-severity vulnerability in Restaurant Brands International assistant…

The RBI assistant platform uses client-side authentication to process equipment orders, meaning the security check happens in your browser instead of on the server. An attacker can bypass this check and submit unauthorized orders.

Client-side authentication validation can be circumvented by intercepting or modifying requests before they reach the server. An attacker with network access or ability to modify local client code can forge equipment orders without valid credentials, bypassing intended access controls.