What is the CVSS score of CVE-2025-62642?

CVE-2025-62642 has a CVSS 3.1 base score of 8.6 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N. EPSS exploitation probability: 0.5%.

Which versions of RBI Assistant are affected by CVE-2025-62642?

The RBI Assistant platform is exposed to unauthenticated account creation, allowing attackers to provision arbitrary users and potentially gain a foothold in connected workflows.

How to fix or mitigate CVE-2025-62642?

Within 24 hours, identify all internet-facing or partner-reachable deployments of the RBI Assistant platform through 2025-09-06, restrict network access to the signup API, and disable or tightly control the 'Anyone Can Join This Party' registration flow; review logs for anomalous account creations and enable enhanced monitoring. Within 7 days, implement compensating controls such as allowlisting trusted source IPs, requiring administrative approval for new accounts, enforcing MFA for new and existing privileged users, and auditing accounts created since 2025-09-06 for unauthorized activity; engage the vendor to confirm exposure and obtain remediation guidance. Within 30 days, apply the vendor-released patch when available, retest account provisioning controls, and update incident response and access review procedures; if no patch is available, maintain the interim restrictions and consider isolating the platform from untrusted networks until a fix is validated.

RBI Assistant CVE-2025-62642

HIGH

Missing Authorization (CWE-862)

2025-10-17 cve@mitre.org

Authentication Bypass Restaurant Brands International Assistant

8.6

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.6 HIGH

AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N

vuln.today AI

8.6 HIGH

Remote unauthenticated signup endpoint with no UI makes AV:N/AC:L/PR:N/UI:N; unauthorized account creation is an integrity impact (I:H) that grants access beyond the signup component, hence S:C, with no direct data disclosure or outage (C:N/A:N).

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:L/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Oct 08, 2026 - 22:42 vuln.today

CVE Published

Oct 17, 2025 - 21:15 nvd

HIGH 8.6

DescriptionNVD

The Restaurant Brands International (RBI) assistant platform through 2025-09-06 has an "Anyone Can Join This Party" signup API that does not verify user account creation, allowing a remote unauthenticated attacker to create a user account.

AnalysisAI

Remote unauthenticated account creation in the RBI Assistant platform through 2025-09-06 allows attackers to provision arbitrary user accounts via the 'Anyone Can Join This Party' signup API, which lacks authorization checks (CWE-862). The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N (8.6 HIGH) confirms network-reachable, low-complexity exploitation requiring no credentials or user interaction, though exploitation is limited to attackers who can reach the proprietary RBI service. No public exploit code or confirmed active exploitation has been identified at time of analysis.

Technical ContextAI

The vulnerability resides in the signup API of the Restaurant Brands International (RBI) assistant platform, identified by CPE cpe:2.3:a:rbi:restaurant_brands_international_assistant:*:*:*:*:*:*:*:* which indicates all versions of the proprietary service are affected through 2025-09-06. CWE-862 (Missing Authorization) is the root cause: the 'Anyone Can Join This Party' endpoint fails to verify that the requesting entity is authorized to create an account, allowing arbitrary account creation without any authentication (PR:N) or user interaction (UI:N). The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N further reveals a scope change (S:C), meaning the vulnerable API component can impact resources beyond its security scope-new accounts may be leveraged for further attacks against the broader RBI platform. Because this is a single proprietary service rather than widely distributed software, exploitation is constrained to attackers who can reach that specific endpoint; there is no configuration toggle or optional feature that mitigates the flaw in default deployments.

RemediationAI

No vendor-released patch has been identified at time of analysis; organizations should contact RBI directly for an official fix. Until a patch is available, the most effective compensating control is to disable the 'Anyone Can Join This Party' signup API endpoint entirely if it is not essential for business operations-this prevents all exploit attempts but blocks legitimate new user registrations. If the endpoint must remain active, restrict network access to it using firewall rules or allowlists so that only trusted IP ranges can reach it, though this may inadvertently block legitimate users from untrusted networks and is not foolproof against attackers who can spoof or route through allowed ranges. Implement additional verification steps in front of the API, such as CAPTCHA challenges, email confirmation loops, or rate limiting, to raise the cost of automated account creation, but note that these do not fully remediate the missing authorization flaw and can degrade user experience. Because the flaw is in a proprietary platform, these controls may require coordination with RBI or deployment of a reverse proxy or WAF to enforce them. Monitor the referenced third-party analyses for updates on patch availability.