Wyndham app hid a password that opened a customer database
Wyndham has acknowledged a cybersecurity incident after a security researcher found a bug that let anyone access customers’ personal information, TechCrunch reported.
Robert Wiggins, a researcher at What Security, told TechCrunch exclusively that he found a password inside the source code of Wyndham’s Android app. The credential granted access to an internal company database hosted by Salesforce.
Wiggins told TechCrunch that the credential exposed personal information including customer names, email addresses and Wyndham member numbers. The database also stores customer login tokens, called JWTs, that keep customers logged in to their apps without re-entering passwords. It also contained Wyndham files and documents.
According to Wiggins, the database had millions of entries, but he was unable to determine an accurate number of exposed customer records. Wyndham touts some 129 million enrolled rewards members.
The researcher said Wyndham has no way to report security flaws, and asked TechCrunch to help alert the company. Soon after TechCrunch contacted Wyndham’s cybersecurity staff, the exposed credential was revoked, preventing any further access to the database.
“Our team has taken steps to address the issue,” a Wyndham spokesperson told TechCrunch. “Our security teams have no evidence of any unauthorized access,” the statement added, without providing further details about the claim.
Asked whether the company had the technical means, such as server logs, to determine if anyone had accessed the customer database before Wiggins’ discovery, the spokesperson would not say. TechCrunch also asked whether Wyndham planned to notify customers whose information was exposed, or disclose the incident to U.S. regulators, such as filing notice with the U.S. Securities and Exchange Commission, as public companies are required to do for material cybersecurity incidents. Wyndham would not say.
The spokesperson also would not say how long the password had been embedded in its customer app, or how Wyndham plans to ship a long-term fix.
Developers generally avoid including passwords or credentials in publicly released software and apps, a practice known as “hardcoding,” because anyone with a copy of the software can extract the password and use it to reach its associated server or database. Because credentials can be abused so simply, many cases of hardcoded credentials are automatically scored with a maximum vulnerability severity rating.
For Wiggins, it is his second public discovery of hardcoded credentials in two weeks, after finding a near-identical vulnerability in Applebee’s app that exposed customer data. Wiggins relied on AI tools for both discoveries, which make it easier to identify simple security weaknesses, such as hardcoded credentials, by scouring thousands of lines of decompiled app code every second.
Asked about Wyndham’s response, Wiggins told TechCrunch he was glad the company fixed the issue, but noted that without visibility into any past activity, someone with malicious intent could have leaked large amounts of customers’ personal information.
The company would not say whether it planned to set up a vulnerability disclosure program to let outside researchers and hackers privately report security vulnerabilities. Michael Francess, Wyndham’s cybersecurity director who responded to the incident, told TechCrunch that researchers can alert [email protected] with details of potential security issues. The spokesperson would not say whether the company plans to change its website to let researchers alert the company.
It is the latest known security incident at Wyndham in recent years. In 2024, a security researcher found several Wyndham hotel check-in desks were running remote-access spyware that was leaking screenshots of guest records and booking information to the open web. Soon after that reporting, the spyware app found on the hotel computers, called pcTattletale, was hacked and its banks of customer data stolen, forcing the company’s owner, Bryan Fleming, to shut down the company. Fleming, a former resident of Michigan, was later arrested by federal authorities and convicted of making, selling and advertising unlawful spyware.
