Hotel chain Wyndham exposed customer data after a security researcher found a password hardcoded into its Android app, granting access to an internal database with names, emails, member numbers and login tokens. Wyndham revoked the credential only after being contacted by a reporter, and said it found no evidence of unauthorized access.
Security researcher Robert Wiggins of What Security found the hardcoded password embedded in the source code of Wyndham’s Android customer app, according to TechCrunch’s report, which first disclosed the finding. The credential granted access to an internal company database hosted on Salesforce. Wiggins told TechCrunch he approached the outlet because Wyndham had no clear channel for researchers to report security flaws directly.
What data was exposed?
The database held customer names, email addresses and Wyndham member numbers, along with login tokens known as JWTs that keep users signed in without re-entering a password. It also stored internal Wyndham files and documents. Wiggins said the database contained millions of entries but that he could not determine exactly how many real customer records were exposed.
Wyndham says it has about 129 million enrolled Wyndham Rewards members worldwide, though that figure describes total program membership rather than the number of records actually exposed in this specific database.
What has Wyndham said?
A Wyndham spokesperson told TechCrunch that “our team has taken steps to address the issue” and that “our security teams have no evidence of any unauthorized access.” The exposed credential was revoked soon after TechCrunch’s security desk contacted the company’s cybersecurity staff.
Wyndham would not say how long the password had been live in the app, whether it can review server access logs to confirm no one else found it first, whether affected customers will be notified, or whether it plans to report the incident to the US Securities and Exchange Commission. Michael Francess, Wyndham’s cybersecurity director, said researchers can report issues directly to the company’s security team by email.
Why do hardcoded credentials keep showing up in company apps?
This is not an isolated case. Wiggins found a near-identical hardcoded database credential in Applebee’s Android app roughly two weeks earlier, a flaw TechCrunch also reported. Wiggins said he used AI-assisted tools to search for both vulnerabilities, a method that has made this class of bug easier for independent researchers to find at scale across many companies’ apps.
A hardcoded credential typically ends up in an app’s code during development or testing and is then shipped to production without being removed, often because it works and nobody flags it during a security review. Once an app is published, anyone who decompiles it can potentially recover that credential and reuse it, which is what happened here.
Security researchers have repeatedly flagged this pattern as one of the most common and most preventable classes of corporate data exposure. It does not require breaking any encryption or exploiting a server vulnerability; the credential sits in plain view inside the app’s compiled code for anyone who knows how to extract it. Companies that rely on mobile apps to connect to internal databases are increasingly being tested for exactly this kind of oversight, often by independent researchers working without any formal engagement from the company itself.
Wyndham has faced data exposure issues before. In 2024, researchers found spyware installed on Wyndham hotel check-in computers that leaked guest records, a separate and unrelated incident.
| Detail | Applebee’s (late Oct 2026) | Wyndham (Nov 2026) |
|---|---|---|
| Flaw type | Hardcoded database password in app code | Hardcoded database password in app code |
| Found by | Robert Wiggins, What Security | Robert Wiggins, What Security |
| Data exposed | Customer personal data | Names, emails, member numbers, login tokens |
| Company response | Database password removed after disclosure | Credential revoked after disclosure |
Frequently asked questions
Should Wyndham Rewards members change their password? Wyndham has not advised customers to do so and has not confirmed any unauthorized access occurred. Members who want to be cautious can still update their password and check recent account activity as a precaution.
Is this the same incident as the 2024 Wyndham check-in computer spyware case? No. That earlier incident involved spyware on physical front-desk computers at some hotels. This incident involves a hardcoded password inside Wyndham’s own Android app, a different system entirely.
Has any customer data actually been stolen? Wyndham says its security team has no evidence of unauthorized access, but it has also acknowledged it cannot fully verify how long the credential was exposed or review historical access logs with certainty.
Leave a Reply