# Wyndham Hotels Exposes Customer Data Through Hardcoded App Credentials A security researcher discovered a password in Wyndham's Android app source code. - **Source:** [TechCrunch](https://techcrunch.com) - **Published:** 2026-11-09 - **Topic:** [technology](https://brifing.si/c/technology) - **Original article:** - **On Brifing:** https://brifing.si/s/b0ced421-036e-4769-9314-db13729d6522 ## Critical Security Lapse Identified Security researcher Robert Wiggins discovered a hardcoded password within Wyndham's Android application source code. This credential provided unauthorized access to an internal Salesforce-hosted database containing sensitive customer information. The vulnerability was identified through code analysis, highlighting a significant failure in the company's secure software development lifecycle and data protection protocols. ## Exposed Customer Information Scope The compromised database contained customer names, email addresses, and unique Wyndham member numbers. Additionally, the system stored JSON Web Tokens, which are authentication tokens used to maintain user sessions. While the exact number of affected records remains unconfirmed, Wyndham manages approximately 129 million enrolled rewards members within its global database. ## Rapid Response and Remediation Following notification from TechCrunch, Wyndham's cybersecurity team revoked the exposed credentials, effectively closing the unauthorized access point. The company stated that it has taken steps to address the issue but provided no evidence regarding whether any malicious actors exploited the vulnerability prior to the researcher's discovery of the flaw. ## Lack of Transparency Concerns Wyndham has declined to disclose whether it possesses server logs to verify if unauthorized access occurred. Furthermore, the company has not confirmed if it will notify affected customers or report the incident to the U.S. Securities and Exchange Commission, despite regulatory requirements for material cybersecurity events involving public companies. ## Risks of Hardcoded Credentials Hardcoding involves embedding sensitive passwords directly into software source code, making them easily extractable by anyone who possesses the application. This practice is widely considered a severe security vulnerability. Modern development standards strictly prohibit this, as it allows attackers to bypass authentication layers and gain direct access to backend infrastructure. ## Emerging Role of AI Tools Researcher Robert Wiggins utilized AI-powered tools to identify this vulnerability by scanning thousands of lines of decompiled code per second. This marks his second discovery of hardcoded credentials in two weeks, following a similar finding in the Applebee's mobile application. AI is increasingly enabling researchers to detect simple, high-impact security weaknesses. ## History of Security Incidents This incident follows a 2024 security breach where Wyndham hotel check-in desks were found running remote-access spyware. That software, known as pcTattletale, leaked guest records and booking information to the public web. The owner of that spyware company was later arrested and convicted by federal authorities for illegal software distribution. ## Future Vulnerability Disclosure Needs Wyndham currently lacks a formal, public-facing vulnerability disclosure program for external security researchers. While the company provides an email address for security alerts, it has not committed to updating its website or processes to facilitate private reporting. Establishing such a program is essential for preventing future data exposures and improving transparency. ## Sources covering this story - https://techcrunch.com/2026/11/09/hotel-giant-wyndham-exposed-customer-data-after-app-security-lapse/ — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._