Wyndham Hotels Exposes Customer Data Through Hardcoded App Credentials
A security researcher discovered a password in Wyndham's Android app source code.
1Critical Security Lapse Identified
Security researcher Robert Wiggins discovered a hardcoded password within Wyndham's Android application source code. This credential provided unauthorized access to an internal Salesforce-hosted database containing sensitive customer information. The vulnerability was identified through code analysis, highlighting a significant failure in the company's secure software development lifecycle and data protection protocols.
2Exposed Customer Information Scope
The compromised database contained customer names, email addresses, and unique Wyndham member numbers. Additionally, the system stored JSON Web Tokens, which are authentication tokens used to maintain user sessions. While the exact number of affected records remains unconfirmed, Wyndham manages approximately 129 million enrolled rewards members within its global database.
3Rapid Response and Remediation
Following notification from TechCrunch, Wyndham's cybersecurity team revoked the exposed credentials, effectively closing the unauthorized access point. The company stated that it has taken steps to address the issue but provided no evidence regarding whether any malicious actors exploited the vulnerability prior to the researcher's discovery of the flaw.
4Lack of Transparency Concerns
Wyndham has declined to disclose whether it possesses server logs to verify if unauthorized access occurred. Furthermore, the company has not confirmed if it will notify affected customers or report the incident to the U.S. Securities and Exchange Commission, despite regulatory requirements for material cybersecurity events involving public companies.
5Risks of Hardcoded Credentials
Hardcoding involves embedding sensitive passwords directly into software source code, making them easily extractable by anyone who possesses the application. This practice is widely considered a severe security vulnerability. Modern development standards strictly prohibit this, as it allows attackers to bypass authentication layers and gain direct access to backend infrastructure.
6Emerging Role of AI Tools
Researcher Robert Wiggins utilized AI-powered tools to identify this vulnerability by scanning thousands of lines of decompiled code per second. This marks his second discovery of hardcoded credentials in two weeks, following a similar finding in the Applebee's mobile application. AI is increasingly enabling researchers to detect simple, high-impact security weaknesses.
7History of Security Incidents
This incident follows a 2024 security breach where Wyndham hotel check-in desks were found running remote-access spyware. That software, known as pcTattletale, leaked guest records and booking information to the public web. The owner of that spyware company was later arrested and convicted by federal authorities for illegal software distribution.
8Future Vulnerability Disclosure Needs
Wyndham currently lacks a formal, public-facing vulnerability disclosure program for external security researchers. While the company provides an email address for security alerts, it has not committed to updating its website or processes to facilitate private reporting. Establishing such a program is essential for preventing future data exposures and improving transparency.