Hotel and resort giant Wyndham has acknowledged a major cybersecurity incident after a security researcher discovered a hardcoded password inside the source code of its Android app. The vulnerability allowed anyone with access to the application to bypass authentication and view internal company databases hosted by tech company Salesforce. Security researcher Robert Wiggins at What Security identified the flaw, which exposed sensitive personal information including customer names, email addresses, and member numbers. The database also contained user login tokens known as JWTs, which keep customers logged into their mobile applications without needing to re-enter credentials repeatedly, alongside various company files and documents.
While Wiggins noted that the database contained millions of entries, he was unable to determine the exact number of exposed customer records. Wyndham officially counts approximately 129 million enrolled rewards members. Because the company lacks a dedicated public vulnerability reporting channel, Wiggins had to alert the company through external media contacts. Soon after the media outlet made contact with Wyndham’s cybersecurity staff, the compromised credential was successfully revoked to prevent any further unauthorized entry.
Key takeaways
- A security researcher found a hardcoded password inside Wyndham's Android app source code.
- The flaw exposed customer names, email addresses, member numbers, and login tokens.
- Wyndham revoked the credential after being alerted, though it remains unclear how long it was exposed.
- The company stated it has no evidence of unauthorized access, but could not confirm if server logs exist to verify past activity.
Response and unanswered questions
Following the intervention, a Wyndham spokesperson stated that the internal team took immediate steps to address the issue. However, the company would not clarify whether it possesses the technical capabilities, such as server logs, to determine if malicious actors accessed the database prior to Wiggins' discovery. Furthermore, Wyndham declined to state whether it plans to notify affected customers or file regulatory disclosures with U.S. authorities, such as the Securities and Exchange Commission, which mandates notifications for material cybersecurity events involving public companies. Representatives also declined to share how long the password remained embedded in the software or how a permanent long-term fix will be deployed.
App and software developers generally avoid embedding passwords or credentials directly into publicly released software, a practice known as hardcoding. When credentials are left inside applications, individuals can easily extract them to gain unauthorized access to associated servers, frequently resulting in maximum severity vulnerability scores. Wiggins utilized artificial intelligence tools to scan thousands of lines of decompiled code to uncover the flaw, marking his second discovery of this nature in a two-week span following a similar incident involving the Applebee's application.
Previous incidents and future vulnerability reporting
This event marks the latest in a series of security challenges for Wyndham in recent years. In 2024, a researcher discovered that several hotel check-in desks were running unauthorized remote-access spyware called pcTattletale, which leaked guest records and booking information to the public web before the spyware platform was ultimately hacked and shut down by federal authorities.
When questioned about establishing a formal bug bounty or vulnerability disclosure program to allow independent researchers to report bugs privately, Wyndham representatives did not indicate any plans to modify their website setup. Michael Francess, Wyndham’s cybersecurity director who handled the response, noted that researchers can currently reach out via email to report potential security issues.
Comments