Wyndham exposed customer data due to a password hardcoded in its app

Password embedded in app code exposed access to customer database

Hotel giant Wyndham has acknowledged a cybersecurity incident after a good-faith researcher discovered a vulnerability that allowed anyone to gain access to customers' personal data. As researcher Robert Wiggins of What Security told TechCrunch, he found a password in the source code of Wyndham's Android app: the credentials provided access to the company's internal database hosted with Salesforce.

What exactly was accessible

According to Wiggins, the credentials exposed customers' names, email addresses, and Wyndham loyalty program member numbers. The database also stored login tokens — so-called JWTs, which allow apps to avoid asking for a password at every sign-in — as well as the company's internal files and documents. The researcher estimated the database at millions of records, but could not determine the exact number of affected customers; meanwhile, Wyndham claims to have about 129 million registered members in its rewards program.

The company's response and open questions

Wyndham, according to the researcher, had no way to report the vulnerability, and he turned to TechCrunch for help. Shortly after contact with the company's security staff, access via the compromised password was revoked. 'Our team took action to address the issue,' a Wyndham spokesperson said, adding that 'our security teams have found no evidence of unauthorized access,' without any supporting details. Asked whether the company has technical means — such as server logs — to establish whether anyone had accessed the database before the discovery, the spokesperson declined to answer. The company also would not say whether it plans to notify affected customers and file a notification with the U.S. Securities and Exchange Commission, which is mandatory for public companies in the event of significant incidents, how long the password had been in the app, or how a long-term fix will be implemented.

Context: a second find in two weeks and last year's incident

Hardcoded passwords in publicly distributed software are considered a dangerous practice: anyone with a copy of the app can extract the credentials and gain access to the server, which is why such cases often receive the maximum severity rating. For Wiggins, this is already his second public discovery of hardcoded credentials in two weeks: earlier he found an almost identical vulnerability in the Applebee's restaurant chain app, which also exposed customer data. In both cases he used AI tools that make it possible to scan thousands of lines of decompiled code per second. This is not Wyndham's first security incident: in 2024, a researcher discovered that the front desks of several hotels in the chain were running spyware pcTattletale, which leaked screenshots of guest records to the open internet; after press coverage, the app itself was hacked, the company was shut down, and its owner Bryan Fleming was later arrested and convicted for creating and selling spyware.