Hotel giant Wyndham acknowledged a security incident after a researcher discovered a hardcoded password in its Android app that granted access to an internal database containing personal information for millions of rewards members. Security researcher Robert Wiggins found the credential embedded in the app's source code, which allowed access to a Salesforce-hosted database storing customer names, email addresses, member numbers, and login tokens.
The database contained millions of entries from Wyndham's 129 million enrolled rewards members, though Wiggins could not determine an exact count of exposed records. The credential was revoked after Wiggins contacted Wyndham through a journalist because the company had no public channel for reporting security vulnerabilities. A Wyndham spokesperson said the company addressed the issue and found no evidence of unauthorized access, but declined to say whether server logs existed to verify that claim.
Wyndham would not disclose how long the password was embedded in the app, whether it plans to notify affected customers, or whether it will report the incident to the Securities and Exchange Commission as required for material cybersecurity events at public companies. Hardcoded credentials are considered a critical security weakness because anyone with the software can extract and use the password, and such vulnerabilities typically receive maximum severity ratings.
This marks the second major discovery of hardcoded credentials by Wiggins in two weeks, following a similar flaw in the Applebee's app. Wiggins used artificial intelligence tools to scan decompiled app code for such weaknesses. Wyndham's cybersecurity director provided an email address for researchers to report issues, but the company declined to say whether it would establish a formal vulnerability disclosure program or update its website to publicize the reporting channel.
Wyndham experienced a separate security incident in 2024 when hotel check-in computers were found running remote-access spyware that leaked guest records to the internet. That spyware company was later hacked and shut down, and its owner was convicted of making and selling unlawful spyware.