Hotel group Wyndham exposed customer data because a password was left in the source code of its Android app, according to a security researcher and a report by TechCrunch, with details also summarized by MLQ. The credential has since been revoked.
What was found. Security researcher Robert Wiggins, of What Security, found the password in the app’s code. It gave access to an internal company database hosted by Salesforce, according to TechCrunch. A password stored inside an app can be pulled out by anyone who downloads and examines the app.
What the database held. The data included customer names, email addresses and Wyndham member numbers, along with customer login tokens, which are credentials that keep users signed in without re-entering a password, and internal Wyndham files and documents. Wiggins said the database held millions of entries but could not determine an accurate count of exposed customer records. Wyndham says it has about 129 million enrolled rewards members, so the possible scale is large, but the exposed number is unknown.
The company’s response. TechCrunch says the credential was revoked soon after it contacted Wyndham’s cybersecurity staff. A Wyndham spokesperson said the team has taken steps to address the issue and that its security teams have no evidence of any unauthorized access. Wiggins noted that without visibility into past activity, someone could have leaked large amounts of data.
What Wyndham did not answer. According to TechCrunch, Wyndham did not say whether it can check server logs for past access, whether it will notify customers, whether it will disclose the issue to US regulators, how long the password was in the app, what the long-term fix is, or whether it will set up a vulnerability disclosure program. The claim of no evidence of unauthorized access therefore sits alongside an open question over whether the company can check.
A pattern. TechCrunch says this is the researcher’s second public discovery of a hardcoded credential in two weeks, after a near-identical flaw in the Applebee’s app, and that AI tools were used to find both. Hardcoded secrets are a well-known mistake, and automated tools make them easier to spot at scale.
Why it matters. Names, emails and member numbers can be used for phishing, and login tokens could in some cases let an attacker access accounts. For Wyndham members in the US and UK, the practical steps are to watch for suspicious emails about bookings or points, to avoid clicking links in unexpected messages, and to change passwords if the company advises it. For developers, the case is a reminder to keep secrets out of apps.
What to watch. Look for a Wyndham notice to customers, a statement on log checks, and whether regulators ask for details.
Sources: TechCrunch and MLQ. Details are as reported and the number of exposed records is not known.
Hotel reception lobby (representative image), Wikimedia Commons, CC BY-SA 4.0
