Wyndham App Security Lapse Exposes Customer Data Through Hardcoded Password
Wyndham recently addressed a significant security vulnerability in its Android application that allowed unauthorized access to a Salesforce-hosted database. According to TechCrunch, the lapse stemmed from a hardcoded password within the app source code, potentially exposing personal details for a portion of the company’s 129 million rewards members to anyone capable of extracting the credential.
Context from Industry Pulse
The Wyndham incident underscores a persistent technical oversight in mobile app development where hardcoded credentials grant direct entry to backend infrastructure. This vulnerability is particularly notable given the scale of Wyndham’s rewards program, which encompasses 129 million members. The discovery by Robert Wiggins using AI-driven code analysis suggests that automated tools are making it increasingly simple for both researchers and malicious actors to identify these basic flaws. Furthermore, the hotel giant's lack of a formal vulnerability disclosure program at the time of discovery created a communication gap that delayed the fix, reflecting broader transparency challenges within the hospitality sector’s cybersecurity frameworks.
Security researcher Robert Wiggins discovered the credential while using artificial intelligence tools to scan decompiled code for weaknesses. As TechCrunch reports, the exposed Salesforce database contained sensitive customer information including full names, email addresses, and specific Wyndham member numbers. More critically, the database held JSON Web Tokens used to maintain active user sessions, which could allow access to accounts without requiring a password. Internal company files and documents were also stored within the same environment.
The vulnerability was reported to the hotel giant after the researcher sought assistance from TechCrunch to establish contact, as the company lacked a formal reporting mechanism for security flaws. Wyndham cybersecurity staff revoked the credential shortly after being alerted, effectively closing the unauthorized access point. While the company confirmed it has taken steps to mitigate the issue, it did not clarify how long the password had been embedded in the publicly available software.
Wyndham told TechCrunch that its internal teams found no evidence of unauthorized access to the data. However, the company declined to confirm if it possesses the server logs necessary to verify this claim or if it intends to notify affected customers and federal regulators. The incident highlights a recurring struggle for the hospitality chain, which faced a separate security crisis in 2024 involving remote-access spyware on hotel check-in computers that leaked guest records to the open web.
Industry standards generally dictate that developers avoid hardcoding credentials because they are easily extracted by third parties. Despite the risks, TechCrunch notes that this is the second time in two weeks that Wiggins has identified a near-identical flaw in a major consumer app. The researcher warned that without better visibility into past database activity, it remains impossible to determine if malicious actors exploited the vulnerability before it was patched.
The Industry Pulse Bottom Line
Wyndham's reliance on hardcoded credentials highlights a critical failure in secure coding practices. The incident serves as a warning that even large enterprises remain vulnerable to simple exploits detectable by basic AI-driven security scanning tools.