What is the CVSS score of CVE-2025-62643?

CVE-2025-62643 has a CVSS 3.1 base score of 8.6 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N. EPSS exploitation probability: 0.3%.

Which versions of RBI Assistant are affected by CVE-2025-62643?

The Restaurant Brands International (RBI) assistant platform, in all versions through 2025-09-06, transmits user account passwords in cleartext inside email messages, so any party with visibility…

Is there a public PoC exploit available for CVE-2025-62643?

Yes, a public proof-of-concept exploit is available for CVE-2025-62643. Prioritise patching immediately. EPSS: 0.3%.

How to fix or mitigate CVE-2025-62643?

Within 24 hours, confirm which RBI assistant platform deployments are running versions up to and including 2025-09-06 and identify every account whose password has been or will be delivered by email; treat those credentials as compromised and force a password reset with unique passwords, and pause all password-in-email workflows on the platform. Within 7 days, require multi-factor authentication on every affected identity, replace plaintext-credential emails with time-limited single-use reset links, restrict and encrypt the mail path carrying platform notifications, and hunt mailbox, mail-gateway, and proxy logs for suspicious access to messages containing credentials. Within 30 days, deploy the vendor fix once released and validate it against the affected version range, migrate remaining accounts off email-delivered secrets, expand monitoring and detections for credential abuse across the identity provider, and re-review the vendor's security advisories and compensating controls with the platform owner to confirm no residual cleartext transmission remains.

RBI Assistant CVE-2025-62643

HIGH

Cleartext Transmission of Sensitive Information (CWE-319)

2025-10-17 cve@mitre.org

Information Disclosure Restaurant Brands International Assistant

8.6

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.6 HIGH

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

vuln.today AI

8.6 HIGH

Cleartext passwords in email are readable by anyone with mail-path access (AV:N/AC:L/PR:N), scope changes as exposed credentials compromise separate accounts (S:C), confidentiality-only impact (C:H, I:N, A:N).

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Oct 08, 2026 - 22:42 vuln.today

CVE Published

Oct 17, 2025 - 21:15 nvd

HIGH 8.6

DescriptionNVD

The Restaurant Brands International (RBI) assistant platform through 2025-09-06 transmits passwords of user accounts in cleartext e-mail messages.

AnalysisAI

Cleartext credential disclosure in the Restaurant Brands International (RBI) assistant platform (versions through 2025-09-06) causes user account passwords to be delivered inside plaintext email messages, so anyone able to observe those messages obtains working credentials in full. The flaw is remotely reachable at low complexity and requires no authentication to the platform and no victim interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N, 8.6 High, CWE-319), but its practical exploitation depends on the attacker having visibility into the credential-bearing email path. Publicly available exploit code exists, and the issue has been widely covered in security press (Malwarebytes, Yahoo News, bobdahacker.com); it has not been confirmed as actively exploited (CISA KEV).

Technical ContextAI

The root cause is CWE-319, cleartext transmission of sensitive information: the RBI assistant platform's account and password-recovery workflow emails credentials unencrypted rather than relying on a tokenized, HTTPS-only reset flow. From a protocol standpoint this places credential material on the SMTP delivery path and, in most configurations, inside intermediate mail relays and mailbox stores, where it can be read without any attacker request to the platform itself. The CPE cpe:2.3:a:rbi:restaurant_brands_international_assistant:*,*:*,*:*,*:*,*:* identifies the affected component as the RBI assistant platform with no version constraint in NVD, matching the description's date-based cutoff of 2025-09-06. The scope change (S:C) in the assessed vector reflects that the vulnerable component is the assistant platform while the impacted security authority is the broader user-credential and email ecosystem; the unchanged integrity (I:N) and availability (A:N) impacts confirm this is a pure confidentiality exposure rather than a code-execution issue.

RemediationAI

No vendor-released patch was identified at time of analysis, so remediation must be driven by eliminating the cleartext credential flow and containing the credentials already exposed. Stop the practice of emailing account passwords entirely and replace it with HTTPS-only, single-use, short-lived password reset tokens or magic links so no reusable secret ever traverses SMTP; this is the only fix that removes the root cause and carries the trade-off of an application change plus a migration for any automated mail templates. Where credentials have already been mailed, force a password reset and rotate affected service/API credentials, since the exposed values must be assumed known. In parallel, harden the mail path: enforce STARTTLS or SMTPS on all outbound relays with MTA-STS and, where feasible, DANE/TLSA, and disable legacy plaintext SMTP ports, accepting that misconfigured relays may drop mail until certificates and policy records are corrected. Restrict and audit access to mail server logs, spool files, and shared mailboxes, and shorten mailbox retention for assistant-related accounts, with the trade-off of reduced troubleshooting visibility. Do not rely on CVSS score alone to prioritize; review the public write-ups cited above for the specific message flows observed, and monitor RBI communications for an official advisory and patched release.