Wyndham Exposed Customer Data Through Android App Security Flaw

Wyndham said it addressed a cybersecurity incident after researcher Robert Wiggins found a hardcoded password in the hotel group’s Android app. The credential provided access to an internal database hosted by Salesforce.

Wiggins told TechCrunch the database contained customer names, email addresses, Wyndham member numbers and login tokens, as well as company files and documents. The tokens, known as JWTs, keep customers signed in to their apps. He said the database had millions of entries, but he could not determine how many customer records were exposed. Wyndham says it has about 129 million enrolled rewards members.

After TechCrunch contacted Wyndham, the company revoked the credential. A spokesperson said its security teams had “no evidence of any unauthorized access,” but did not say whether the company could check server logs for earlier access. Wyndham also did not say whether it would notify affected customers or U.S. regulators, how long the password had been in the app, or how it planned a long-term fix.

Wiggins said he was glad the issue was fixed, while noting that the company’s lack of visibility into past activity could leave open the possibility that someone had accessed or leaked customer information. Wyndham’s cybersecurity director told TechCrunch that researchers can report potential security issues by email.

TechCrunch reported that this was Wiggins’ second public discovery of hardcoded credentials in two weeks. He used AI tools in both investigations. The report also described a separate 2024 incident involving spyware on several Wyndham hotel check-in desks.