A database password sitting inside Wyndham’s own Android app was enough to open an internal customer database to anyone who went looking, according to a security researcher who found it. Wyndham Hotels & Resorts has acknowledged the issue and revoked the credential, but it has not said how long the password was exposed or whether anyone used it before the researcher did.
The lapse matters because of what sat behind it. The researcher reported that the database held customer names, email addresses, Wyndham Rewards member numbers and the login tokens that keep customers signed in to the app, along with internal company files and documents.
A hardcoded credential in a public app
Security researcher Robert Wiggins of What Security reportedly found the credential while examining the decompiled code of Wyndham’s Android app. The password granted access to an internal Wyndham database hosted on Salesforce’s platform.
Hardcoding a credential into a publicly distributed app is a well-known mistake. Anyone who downloads the app can extract the code, and anything embedded in it, so the password effectively belonged to every user with the patience to look. Flaws of this kind are commonly scored at or near maximum severity for exactly that reason.
The researcher said he used AI tools to sift through the app’s code, which makes finding simple weaknesses like embedded passwords far faster. It was reportedly his second discovery of the kind in two weeks, after a near-identical issue in the Applebee’s app also exposed customer data.
What was reachable
According to the researcher, the database contained millions of entries, though he could not determine how many were customer records. Wyndham says its rewards program has about 129 million enrolled members, but that figure covers the whole program and is not a count of affected people. The data reportedly reachable included:
- Customer names and email addresses
- Wyndham Rewards member numbers
- JSON Web Tokens (
JWT) used to keep customers logged in to the app - Internal Wyndham files and documents
The tokens are the most sensitive item on that list. A valid, unexpired session token can let whoever holds it act as the logged-in customer without knowing a password. Revoking the database password closes the route into the database, but it does not by itself invalidate tokens that may already have been copied. Wyndham has not said whether it has expired or reset the stored tokens.
Wyndham says no evidence of misuse
The researcher said Wyndham offered no clear way to report security flaws, so he sought help from reporters to reach the company. Shortly after Wyndham’s security staff were contacted, the exposed credential was revoked.
“Our team has taken steps to address the issue,” a Wyndham spokesperson said, according to reports. “Our security teams have no evidence of any unauthorized access.”
The company declined to say whether it has logs that would show earlier access to the database, how long the password was embedded in the app, whether it will notify customers or regulators such as the U.S. Securities and Exchange Commission, or how it plans to permanently fix the app. Wyndham’s cybersecurity director said researchers can report issues to the company’s security email address. Wyndham had not issued any public statement on its website at time of publication.
What Wyndham Rewards members can do
There is no evidence so far that the data was taken by anyone other than the researcher. Still, members who use the Android app can limit their exposure by signing out of the app and back in, which should issue a fresh session, and by changing their Wyndham Rewards password. Because names, email addresses and member numbers were reachable, members should also be wary of emails that cite their rewards number or promise points, upgrades or account problems.
Exposed Salesforce-hosted customer data has been a recurring theme this year, though usually through stolen access rather than an embedded password. Cases include the Klue supply chain breach and ShinyHunters’ alleged theft of 700,000 BCD Travel records. This is also not Wyndham’s first brush with exposed guest data: in 2024, check-in computers at several Wyndham hotels were found running the pcTattletale spyware, which leaked screenshots of guest records to the open web.
