Restaurant Brands International Drive-Thru Audio Vulnerability

A vulnerability in the Restaurant Brands International (RBI) assistant platform, affecting through September 6, 2025, allows remote attackers to manipulate the audio volume of Drive Thru speakers. This issue arises from improperly configured user sign-up options in AWS Cognito, which were exploited to gain unauthorized access to sensitive functionalities and data across RBI's brand platforms, including Burger King, Tim Hortons, and Popeyes.

Impact

Exploitation of this vulnerability allows for unauthorized adjustment of Drive Thru speaker audio levels, potentially disrupting service and customer experience.