Wyndham Hotel Group Exposes Customer Data via Hardcoded App Credentials
A security researcher discovered a password in Wyndham's Android app source code.
1Security Lapse Exposed Data
Wyndham recently acknowledged a significant cybersecurity incident involving its Android application. Security researcher Robert Wiggins discovered a hardcoded password within the app's source code, which granted unauthorized access to an internal Salesforce-hosted database. This vulnerability potentially exposed sensitive personal information belonging to millions of the hotel giant's enrolled rewards members.
2Scope of Exposed Information
The compromised database contained customer names, email addresses, and unique member numbers. Furthermore, the system stored login tokens, known as JWTs, which allow users to remain logged into their accounts without re-entering passwords. The database also held various internal company files and documents, posing a substantial risk to user privacy.
3Researcher Facilitated Rapid Fix
Wyndham lacked a formal channel for reporting security flaws, forcing the researcher to contact media to alert the company. Once TechCrunch facilitated communication with Wyndham's cybersecurity team, the exposed credentials were revoked. The company claims it has no evidence of unauthorized access, though it provided no technical logs to support this.
4Risks of Hardcoded Credentials
Hardcoding involves embedding sensitive passwords directly into software source code, a practice widely considered a critical security failure. Because anyone with the app can extract these credentials, such vulnerabilities are typically assigned the highest severity ratings. This incident highlights the persistent danger of including authentication secrets in publicly distributed mobile applications.
5AI-Driven Vulnerability Discovery
Robert Wiggins identified this flaw using AI-powered tools designed to scan thousands of lines of decompiled code per second. This marks his second discovery of hardcoded credentials in two weeks, following a similar finding in the Applebee's app. These tools are increasingly effective at uncovering simple but dangerous software development oversights.
6Lack of Transparency Concerns
Wyndham has refused to clarify whether it will notify affected customers or disclose the incident to U.S. regulators. The company also declined to state how long the password remained embedded in the app or if it possesses the server logs necessary to audit past access. This silence raises questions regarding corporate accountability.
7History of Security Issues
This incident follows a 2024 security failure where Wyndham hotel check-in desks were found running spyware. That software, called pcTattletale, leaked guest records and booking information to the open web. The spyware developer was eventually arrested by federal authorities, marking a recurring pattern of security challenges for the hotel chain.
8Future Vulnerability Management
Wyndham currently lacks a dedicated vulnerability disclosure program for external researchers. While the cybersecurity director noted that researchers can email the company, management has not committed to creating a formal portal. Moving forward, the company faces pressure to improve its security posture and establish transparent protocols for handling future digital threats.