Wyndham customer database exposed by password hardcoded in Android app

Hotel and resort giant Wyndham has confirmed a security lapse that left customer data accessible, after a researcher discovered a working password buried in the source code of the company's Android app.

According to TechCrunch, researcher Robert Wiggins of What Security found that the hardcoded password opened an internal Wyndham database hosted by Salesforce. The database contained customer names, email addresses and Wyndham member numbers, along with login tokens known as JWTs that keep app users signed in without re-entering their passwords. Internal Wyndham files and documents were also stored there.

Millions of entries, no firm count

Wiggins told TechCrunch the database held millions of entries, though he could not establish how many customer records were exposed. For context, Wyndham says it has roughly 129 million enrolled rewards members.

The fix arrived by way of the press

Wiggins said Wyndham had no channel for reporting security flaws, so he asked TechCrunch to alert the company on his behalf. Shortly after the outlet contacted Wyndham's cybersecurity staff, the credential was revoked and the database could no longer be reached with it.

"Our team has taken steps to address the issue," a Wyndham spokesperson told TechCrunch, adding that the company's security teams have found "no evidence of any unauthorized access" — without offering detail to support the claim. Asked whether Wyndham actually has the technical means, such as server logs, to check whether the database was accessed before Wiggins found it, the spokesperson declined to answer.

The company also would not say whether it plans to notify affected customers, whether it will report the incident to U.S. regulators such as the Securities and Exchange Commission, how long the password had been embedded in the app, or how it intends to fix the problem permanently.

A textbook mistake, discovered with AI

Hardcoding secrets into publicly released software is a widely discouraged practice, since anyone who obtains a copy of the app can extract the credential and use it against the systems it protects. Because abuse is so straightforward, hardcoded credentials frequently receive the maximum severity rating in standard vulnerability scoring.

This was the second such find in two weeks for Wiggins, who had previously surfaced a similar flaw in Applebee's app. He credited AI tools for both discoveries, saying they can chew through decompiled app code far faster than a human reviewer, which makes simple flaws like embedded passwords easier to catch. Wiggins welcomed Wyndham's fix but cautioned that without any view into historical activity, a malicious actor could already have pulled large volumes of customer data without being noticed.

Wyndham would not commit to launching a vulnerability disclosure program. Michael Francess, Wyndham's cybersecurity director, who handled the incident, told TechCrunch that researchers can contact the company by email with details of potential security issues, but the spokesperson would not say whether the website will be updated to point researchers there.

Latest in a string of incidents

As TechCrunch notes, this is not Wyndham's first recent security problem. In 2024, a researcher found that check-in desks at several Wyndham hotels were running remote-access spyware called pcTattletale, which leaked screenshots of guest records and booking details onto the open web. That spyware operation was itself later hacked and its data stolen, and its owner, Bryan Fleming, was arrested by federal authorities and convicted over the unlawful spyware.

Why it matters

The episode is a case study in preventable failure: a live credential shipped inside a public app, guarding a database full of personal information. The presence of JWTs deserves particular attention, because stolen session tokens can let an attacker take over accounts without ever needing a victim's password.

It also illustrates the gap between having no evidence of misuse and having the ability to detect misuse at all. If a company cannot or will not confirm it holds the logs needed to audit past access, customers have no way of knowing whether their records were touched. And as AI-assisted analysis makes short work of decompiled app code, sloppy secrets that once hid in obscurity will keep surfacing. Companies without a way to receive reports from outside researchers will keep learning about their vulnerabilities from journalists instead.