Hospitality giant Wyndham has confirmed a significant security lapse after a researcher discovered a hardcoded password inside its Android app, which exposed millions of customers’ personal information housed in a Salesforce-hosted database. The flaw detailed credentials that granted access to records including names, email addresses, member ID numbers, login tokens (JWTs), and internal documents. Wyndham operates a loyalty program with approximately 129 million enrolled members.
Discovery and Fix
Security researcher Robert Wiggins uncovered the issue when he found the password embedded in the publicly available code for Wyndham’s Android app. This password was linked to a Salesforce database used internally by Wyndham, which gave access to sensitive customer data and relevant security tokens. The database also contained other Wyndham files and documents. The full number of customer records exposed remains unknown.
After Wyndham was alerted by the researcher and contact was made through Vulcan TechCrunch, Wyndham’s cybersecurity team immediately revoked the credential and secured the database. A company spokesperson stated there was no evidence of unauthorized access, but did not elaborate on whether they had logs to confirm past misuse, how long the hardcoded password had been present, or whether customers would be notified.
Corporate Responsibility and Previous Incidents
Wyndham has been criticized for the lack of a formal vulnerability-disclosure program. The company directs security researchers to a generic email address, but has not committed to setting up a publicly documented process for reporting bugs. The duration of the credential’s presence in the app and Wyndham’s plans for long-term remediation remain unclear.
This isn’t Wyndham’s first public security problem. In 2024, remote-access spyware found on hotel front-desk computers was leaking screenshots of guest and booking information. The spyware, named pcTattletale, was later breached itself, and data believed stolen led to legal consequences, including an arrest and conviction tied to its operation and sale.
Why Hardcoded Credentials Are Dangerous
Developers are warned against embedding credentials inside software because such hardcoded secrets can be easily extracted, especially when the software is publicly distributed. These flaws are generally treated as high severity vulnerabilities because of how straightforward it is for attackers to abuse them.
Analytical angle: This incident highlights two systemic issues in cybersecurity for large service companies. First, embedding credentials in public app code remains a surprisingly common lapse despite years of warnings and best‐practice guidelines. Second, transparency around breaches—including how long vulnerabilities were live, whether data was accessed, and whether consumers will be notified—is essential for trust. Organizations like Wyndham still lag in providing clear vulnerability reporting channels. As more services operate at global scale, even small oversights in app security can lead to massive exposures. The real risk now isn’t just an isolated flaw—it’s how companies prepare for detection, response, and accountability to protect users’ data.
