Wyndham Fixes App Security Vulnerability That Exposed Customer Database
Hotel and resort giant Wyndham has taken action to resolve a cybersecurity issue following the discovery of a flaw in its Android application that left customer information accessible, according to reporting by TechCrunch. Good-faith security researcher Robert Wiggins at What Security discovered a password embedded directly within the source code of the company's Android app.
The hardcoded credential granted access to an internal company database hosted by Salesforce. The database stored personal information including customer names, email addresses, and Wyndham member numbers. It also contained customer login tokens, known as JWTs, which keep users logged into their applications without re-entering passwords, alongside internal Wyndham files and documents.
Database Flaw and App Credentials
According to Wiggins, the internal database contained millions of entries, though he was unable to calculate an exact figure for the total number of exposed customer records. Wyndham publicly states that it has roughly 129 million enrolled rewards members.
Software developers generally avoid placing credentials directly into public software, a practice called hardcoding. Because anyone with access to an app can extract hardcoded credentials to reach linked databases, such vulnerabilities are frequently assigned the highest severity ratings. Wiggins used artificial intelligence tools to identify the flaw by scanning thousands of lines of decompiled application code.
Wyndham Response and Reporting Channels
Wiggins noted that Wyndham lacked a public mechanism to report security flaws and requested assistance from TechCrunch to notify the hotel firm. After TechCrunch contacted Wyndham's cybersecurity team, the exposed credential was revoked to prevent further access.
A Wyndham spokesperson told TechCrunch that the team took steps to address the issue, adding that security teams have no evidence of unauthorized access. However, the spokesperson did not clarify whether the company possesses the technical logs required to determine if unauthorized parties accessed the database before the credential was revoked.
Wyndham also declined to state how long the password remained inside the application, how it plans to implement a long-term software update, or whether it intends to notify impacted customers or file disclosures with regulatory agencies such as the U.S. Securities and Exchange Commission.
Vulnerability Disclosure and Previous Incidents
Regarding reporting protocols, Wyndham did not state whether it will launch a formal vulnerability disclosure program for outside researchers. However, Michael Francess, Wyndham's cybersecurity director who responded to the incident, told TechCrunch that researchers may send details of potential vulnerabilities to a designated security email address.
Wiggins expressed satisfaction that the bug was resolved but observed that without historical system visibility, malicious actors could have previously extracted customer data. This marks Wiggins' second discovery of hardcoded credentials in two weeks, following a similar security weakness found in Applebee's application.
The vulnerability follows another cybersecurity incident involving Wyndham properties. In 2024, a security researcher found that check-in computers at several Wyndham hotels were running a spyware application named pcTattletale, which leaked screenshots of guest records and bookings online. Following public reporting, pcTattletale was compromised and customer data was stolen, leading owner Bryan Fleming to close the firm. Fleming was subsequently arrested and convicted by federal authorities for manufacturing and selling unlawful spyware.
