GoKawiilWyndham hotel app exposed customer data via hardcoded database password
Security researcher Robert Wiggins found a password embedded in Wyndham's Android app source code that granted access to an internal Salesforce-hosted database containing customer names, emails, member numbers, login tokens, and company documents. Wiggins reported the issue to TechCrunch, which notified Wyndham; the exposed credential was revoked shortly after. Wyndham said it found no evidence of unauthorized access but did not clarify whether it has logs to verify that claim.
GoKawiil's interpretation of the reporting above, not reported fact.
The lack of a formal vulnerability disclosure channel at Wyndham meant a researcher had to rely on a journalist to reach the company's security team, suggesting gaps in how the hotel chain handles reported flaws. With 129 million rewards members enrolled, the scale of potential exposure could be significant if the credential had been found earlier by bad actors, and Wyndham's silence on regulatory disclosure or customer notification leaves open questions about compliance with breach reporting rules.
- A hardcoded password in Wyndham's Android app exposed a Salesforce database with customer personal data and login tokens.
- Wyndham had no apparent process for researchers to report security flaws, requiring TechCrunch's intervention.
- Wyndham has not confirmed whether it will notify affected customers or regulators, nor whether it can verify if the data was accessed before discovery.
YubiKey 5C NFC Security Key — With hotel apps and loyalty accounts leaking credentials, adding hardware-based two-factor authentication to your sensitive accounts is a smart move. A YubiKey lets you lock down email and travel accounts so stolen passwords or tokens alone can't grant access to your personal data.
See YubiKey 5C NFC Security Key on Amazon → Affiliate link — we may earn a commission on purchases, at no extra cost to you. Product picked by AI based on this article; it is not a tested recommendation.Source: techcrunch.com — Zack Whittaker, 2026-11-09
Published there as: “Hotel giant Wyndham exposed customer data after app security lapse”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.