A Password Left in Wyndham's Android App Opened Its Customer Database, and Wyndham Won't Say Who Else Got In

Anyone who downloaded Wyndham's Android app was carrying a key to the hotel giant's customer database. Security researcher Robert Wiggins of What Security found a password sitting in the app's source code that unlocked an internal Wyndham database hosted on Salesforce, and Wyndham has now acknowledged the incident and revoked the credential.

The database held customer names, email addresses and Wyndham member numbers, according to Wiggins. It also stored the login tokens (JWTs) that keep customers signed in to the app without typing a password, along with internal company files and documents. He said it ran to millions of entries but could not pin down how many customer records were exposed. Wyndham says it has about 129 million rewards members.

No way to report it

Wiggins found no channel to tell Wyndham about the flaw, so he asked TechCrunch to alert the company. Soon after the outlet reached Wyndham's security staff, the password stopped working.

Wyndham's statement was short: "Our security teams have no evidence of any unauthorized access." The company would not say whether it has the server logs needed to check that, how long the password was in the app, whether it will notify customers, or whether it will file a disclosure with the SEC, as public companies must for material cyber incidents. Its cybersecurity director said researchers can write to [email protected], but the company would not say if it plans to publish that anywhere.

The second one in two weeks

Hardcoding a credential into a shipped app is one of the oldest mistakes in mobile security, because anyone can decompile the app and pull the secret out. It is usually rated at maximum severity for that reason.

Wiggins has now found the same flaw twice in two weeks. In late October he discovered a nearly identical password in Applebee's Android app that exposed customer names, birth dates, phone numbers and login IP addresses. In both cases he used AI tools to comb through thousands of lines of decompiled code, the kind of tedious search that used to take a person days and now takes seconds.

That cuts both ways. The same tools are available to people who would not have called a reporter, and without logs, neither Wyndham nor its customers can know whether one of them got there first.

It is not Wyndham's first brush with this kind of exposure. In 2024, a researcher found check-in desks at several Wyndham hotels running pcTattletale, consumer spyware that was leaking screenshots of guest records and bookings to the open web.

Some offers on this page may be paid placements or contain affiliate links.