A Password Buried in Wyndham's Android App Opened the Door to Customer Data

Imagine shipping a mobile app to millions of users with a live password buried in the code. That's exactly what a security researcher says he found inside Wyndham's Android app — and it opened a door into an internal database holding customer details. If you build or ship apps for a living, this one deserves five minutes of your attention.

According to TechCrunch, Robert Wiggins of What Security discovered a hardcoded credential in the app's source code. That single string was enough to reach an internal database hosted on Salesforce, the platform Wyndham uses behind the scenes.

What was actually exposed

The data Wiggins could reach included customer names, email addresses and Wyndham member numbers. More worrying: the database also held login tokens — JWTs — the kind that keep you signed in to an app so you don't have to retype your password every time. Anyone holding those tokens could potentially impersonate a signed-in user. The database also contained company files and documents.

Wiggins described the database as holding millions of entries, though he couldn't pin down an exact number of affected customers. For context, Wyndham advertises roughly 129 million enrolled rewards members.

The awkward part: nowhere to report it

Here's the detail that bothers me most. Wiggins reportedly had no clear channel to report the flaw, so he went to TechCrunch instead. Only after the outlet contacted Wyndham's security staff was the credential revoked, cutting off access to the database.

To its credit, Wyndham moved once it knew. A spokesperson told TechCrunch the team "has taken steps to address the issue" and that its security teams have "no evidence of any unauthorized access." That's a standard line, and it came without supporting detail.

The questions Wyndham wouldn't answer

TechCrunch asked the obvious follow-ups, and the answers didn't come. The company wouldn't say whether it keeps server logs capable of showing if anyone touched the database before the researcher found it. It wouldn't say whether affected customers would be notified, or whether it plans to file a notice with the SEC — something public companies are generally expected to do for material cyber incidents.

It also declined to say how long the password sat inside the app, what the permanent fix looks like, or whether it will finally set up a vulnerability disclosure program so researchers can report issues privately. Wyndham's cybersecurity director, Michael Francess, pointed TechCrunch to an email address researchers can use in the meantime, but the company wouldn't confirm it plans to publish that route on its website.

This isn't Wyndham's first rodeo

In 2024, a researcher found check-in desks at several Wyndham hotels running remote-access spyware that was leaking screenshots of guest records and booking data to the open web. That software, pcTattletale, was later itself compromised and its owner, Bryan Fleming, was arrested and convicted over making and selling unlawful spyware.

What developers should take from this

Hardcoding secrets in shipped software is a classic mistake, and it stays fatal because anyone with the app package can pull the strings out. If a key lives in client code, treat it as public. Secrets belong on the server, behind short-lived tokens and strict access rules, and they should be rotatable in minutes.

The second lesson is process, not code. A company with 129 million members should have a security@ inbox that someone actually reads, plus a disclosure policy researchers can find. When the only path to reporting a bug is a journalist, you've lost control of the timeline — and you'll spend the next week answering questions you could have avoided.