Wyndham App Exposed Customer Data Through a Password Hidden in Its Code

Robert Wiggins, a security researcher at What Security, told TechCrunch that the credential opened a database hosted by Salesforce containing customer names, email addresses and Wyndham member numbers. The database also stored login tokens, known as JWTs, that keep customers signed in to the app, as well as internal company files and documents. Wiggins said the database held millions of entries but he could not determine how many customer records were exposed. Wyndham says it has some 129 million enrolled rewards members.

The flaw matters beyond one hotel chain because Wiggins said he found it with AI tools that can scan thousands of lines of decompiled app code every second for simple weaknesses such as hardcoded credentials. It is his second such public find in two weeks, after a near-identical flaw in Applebee's app that exposed customer data. Hardcoding a password into publicly distributed software lets anyone who downloads it extract the credential, and such flaws are often given the maximum severity rating.

Wiggins said Wyndham had no channel for reporting security flaws, and he asked TechCrunch to alert the company. The credential was revoked soon after the publication contacted Wyndham's security staff.

"Our team has taken steps to address the issue," a Wyndham spokesperson told TechCrunch, adding that the company's security teams had "no evidence of any unauthorized access." The spokesperson would not say whether Wyndham had server logs that could show whether anyone accessed the data before the discovery, how long the password had been in the app, whether customers would be notified, or whether the company would disclose the incident to the US Securities and Exchange Commission, which requires public companies to report material cybersecurity incidents.

Michael Francess, Wyndham's cybersecurity director, said researchers could report issues by email, but the company would not say whether it plans to set up a formal vulnerability disclosure programme. Wiggins said he was glad the issue was fixed, but warned that without visibility into past activity, a malicious actor could have taken large amounts of customer data.