Wyndham app password exposed a database with millions of entries

By Grace Kim

A password hardcoded in the Android app of hotel and resort group Wyndham granted anyone who extracted it access to a Salesforce database with millions of entries, security researcher Robert Wiggins told TechCrunch.

The researcher could not determine an accurate number of affected customer records. Wyndham touts 129 million enrolled rewards members. TechCrunch described Wiggins as a good-faith researcher who asked the publication to help warn the company.

What did the exposed credential reveal?

Wiggins said he found the password in the source code of Wyndham’s Android app. The credential opened an internal company database hosted by Salesforce, he told TechCrunch.

The database stored customer names, email addresses and Wyndham member numbers. It also held customer login tokens, called JWTs, that keep customers logged into their apps without repeatedly entering their own passwords. Wyndham files and documents were also stored there.

According to Wiggins, the database had millions of entries. The exact number of exposed customer records remained unknown.

TechCrunch’s reporting leaves the customer count unresolved, even as the database entry total reached millions.

How quickly did Wyndham revoke the credential?

Wiggins said Wyndham offered researchers no way to report security flaws. He asked TechCrunch for help alerting the company. Soon after TechCrunch contacted Wyndham’s cybersecurity staff, Wyndham revoked the exposed credential and prevented further access.

“Our team has taken steps to address the issue,” a Wyndham spokesperson told TechCrunch. “Our security teams have no evidence of any unauthorized access,” the statement added, without providing any further details about the claim.

On the record, Wyndham confirmed a fix but did not say whether anyone had used the credential before revocation.

What has Wyndham disclosed about monitoring and notice?

TechCrunch’s questions to Wyndham’s spokesperson covered four unresolved areas:

• Whether Wyndham had server logs or other technical means to determine if anyone accessed the customer database before Wiggins discovered the flaw.
• Whether the company planned to notify customers whose information was exposed.
• Whether Wyndham planned to disclose the incident to U.S. regulators, including through an SEC filing.
• How long the password had been embedded in the app, and how Wyndham would ship a long-term fix.

TechCrunch noted that public companies are required to file notice with the U.S. Securities and Exchange Commission for material cybersecurity incidents. The spokesperson would not say whether Wyndham would notify customers or file that notice.

On the record, Wyndham confirmed revocation but left historical access, customer notice and a permanent repair timetable unanswered.

Can researchers report future security flaws?

Wyndham would not say whether it planned to set up a vulnerability disclosure program that would allow outside security researchers and hackers to report flaws privately.

Michael Francess, Wyndham’s cybersecurity director who responded to the incident, told TechCrunch that researchers can alert the company’s published security email address with details of potential security issues. The spokesperson would not say whether Wyndham would change its website so researchers could alert the company.

Francess supplied a contact point, but Wyndham did not confirm a formal disclosure program.

How did Wiggins find two hardcoded credentials?

TechCrunch reported that this was Wiggins’s second public discovery of hardcoded credentials in two weeks. His first was a near-identical vulnerability in Applebee’s app that exposed customer data.

Wiggins relied on AI tools for both discoveries. TechCrunch said the tools make simple security weaknesses easier to identify by scouring thousands of lines of decompiled app code every second.

TechCrunch noted that app and software developers generally avoid including passwords or credentials in publicly released software and apps, a practice known as “hardcoding.” Anyone with a copy can extract the password and use it to access the associated server or database. Many hardcoded-credential cases automatically receive a maximum vulnerability-severity rating.

Wiggins told TechCrunch he was glad the company fixed the issue. Without visibility into past activity, he warned, someone with malicious intent could have leaked large amounts of customers’ personal information.

AI tools helped surface the same class of credential flaw twice in two weeks.

What happened at Wyndham hotels in 2024?

TechCrunch called the app incident Wyndham’s latest known security incident in recent years. In 2024, a researcher found several Wyndham hotel check-in desks running remote-access spyware that leaked screenshots of guest records and booking information to the open web.

Soon after TechCrunch’s reporting, the spyware app on the hotel computers, called pcTattletale, was hacked and its banks of customer data stolen. Its owner, Bryan Fleming, shut down the company.

Fleming, a former Michigan resident, was later arrested by federal authorities and convicted of making, selling and advertising unlawful spyware.

The contrast is clear in TechCrunch’s reporting: the 2024 case involved data taken from hotel computers, while the app flaw exposed a corporate database.

After TechCrunch’s questions, three issues remain open: how long the password stayed live, whether Wyndham’s logs can identify earlier access, and whether the company will notify customers or U.S. regulators.