Restaurant Brands International Assistant Platform JWT Vulnerability Allowing Unauthorized AWS Upload URL Access

A vulnerability exists in the Restaurant Brands International (RBI) assistant platform, affecting through September 6, 2025. The issue arises from the platform's functionality of returning a JSON Web Token (JWT) that can be used to request a signed Amazon Web Services (AWS) upload URL for any store's path. This vulnerability could potentially be exploited to access and manipulate store-specific data and systems.

Impact

Exploitation of this vulnerability could lead to unauthorized access to AWS upload URLs, allowing for the upload of files to specified store paths. Additionally, it could enable access to sensitive store data and systems, including voice recordings of drive-thru orders, employee accounts, store analytics, and sales data.