Plot hole: In Tokyo Drift Twinkie tells Sean that Dom has been racing and beating drivers around Asia, but in this film Dom only goes to Tokyo for day or two as he tells Mia to tell Brian that he will see him in Los Angeles in two days.
Plot hole: The only reason Kate is brought onto Matt's team is to give the CIA legal authority to operate on US soil. Given that he already has DEA agents and US Marshals on the team, all of whom seem to be fully aware of what he is doing and have no problem with it, this doesn't make a great deal of sense. Her idealism makes her a poor choice for the sort of operations the team is doing, and there are already domestic US agents available.
Plot hole: When Bryan goes to the Russian bad guys' heavily-guarded apartment/office building, they make a point of saying that a guard upstairs monitors a camera and operates the elevator allowing only certain people to come up. Brian manages to trick the elevator operator into letting him up, then proceeds to kill him and all the other guards on the way to the apartment. How does he end up using the elevator to get back down when everyone is dead? And who is letting the cops up to the apartment when they show up well after everyone had been killed?
Plot hole: Garriga shows a small thumb-sized device, claiming it changes his password every 15 minutes, thus protecting his servers against brute-force attacks. In real life, remote servers are resilient to brute-force attacks because they restrict wrong guesses. Worse, changing the password every 15 minutes means Garriga would never know a password that can be reused indefinitely within 15 minutes! In real life, we use time-based one-time passwords (TOTP) and 2FA instead.