Wyndham app had hardcoded password exposing customer data
Original: Hotel giant Wyndham exposed customer data after app security lapse
Why This Matters
Hardcoded credentials in consumer apps remain a persistent, high-severity class of vulnerability.
Researcher Robert Wiggins found a hardcoded password in Wyndham's Android app granting access to a Salesforce database holding names, emails, member IDs, and JWT login tokens for the hotel chain's up to 129 million rewards members.
Security researcher Robert Wiggins of What Security told TechCrunch he extracted a password embedded directly in Wyndham's Android app source code. That credential opened an internal Salesforce-hosted database containing customer names, email addresses, Wyndham member numbers, and JWT login tokens—the session keys that keep users logged in without re-entering passwords. The database also held internal Wyndham files and documents. Wiggins estimated millions of entries but could not pin down an exact count of affected records.
Wyndham had no public channel to report security flaws, so Wiggins asked TechCrunch to relay the finding. After TechCrunch contacted Wyndham's security staff, the credential was revoked. A Wyndham spokesperson said the team "has taken steps to address the issue" and claimed "no evidence of any unauthorized access"—but declined to say whether server logs even exist to verify that claim. The company also wouldn't confirm plans to notify customers, file an SEC disclosure, or explain how long the password had been baked into the app.
Hardcoding credentials in publicly distributed software is a well-known, easily exploited mistake; such flaws often receive maximum severity scores automatically. This is Wiggins' second hardcoded-credential find in two weeks—he disclosed a near-identical issue in the Applebee's app just before this discovery.