Wyndham Acknowledges Incident After Hardcoded Credential in Android App Exposed Customer Database

Wyndham has acknowledged a cybersecurity incident after security researcher Robert Wiggins, of What Security, found a bug that allowed access to customers' personal information. Wiggins reported the finding exclusively to TechCrunch, which published it on November 9, 2026.

The flaw was a hardcoded credential. Wiggins found a password in the source code of Wyndham's Android app, and that password granted access to an internal company database hosted by Salesforce. The database held customer names, email addresses and Wyndham member numbers. It also stored the JWTs (JSON Web Tokens) that keep customers signed in to apps, and it contained Wyndham files and documents.

The database held millions of entries. The exact number of exposed customer records could not be determined. Wyndham reports about 129 million enrolled rewards members, but that figure describes its membership base, not the number of records the credential reached.

Wiggins used AI tools to identify the hardcoded credentials by scouring decompiled app code. According to the report, this was his second public hardcoded-credentials discovery in two weeks, following a near-identical vulnerability in Applebee's app.

Wiggins told TechCrunch that Wyndham had no way to report security flaws, so he asked the outlet to help alert the company. After TechCrunch contacted Wyndham's cybersecurity staff, the exposed credential was revoked, which prevented further access to the database.

Wyndham told TechCrunch that its team had taken steps to address the issue and that its security teams had no evidence of unauthorized access. The company declined to say whether it had technical means, such as server logs, to determine whether anyone had accessed the customer database before the credential was revoked. It also declined to say whether it would notify affected customers or disclose the incident to U.S. regulators, including the SEC.

In my view, the JWTs deserve more attention than the headline credential. A leaked password exposes one account surface, but a valid session token can let an attacker act as a logged-in customer until it expires or is invalidated. Whether Wyndham can rule out that use depends on its token lifetimes and revocation practices, and the company has not described either. The "no evidence of unauthorized access" statement is only as strong as the logging behind it, which is the same question Wyndham declined to answer.

The broader context here is a recurring pattern in mobile development. Secrets embedded in client binaries are easy to extract from a decompiled APK, and the same tooling that helps a researcher find them can help anyone else. Wiggins's use of AI to sift decompiled code shows how much of that search can now be automated, which lowers the effort required to find these flaws in any app that ships with embedded credentials. The same automation is available to the teams that maintain those apps, and secret scanning in CI pipelines and token rotation are well-understood controls.

The reporting path is the other detail worth weighing. Wiggins said the company offered no way to report vulnerabilities, and the flaw was closed only after a journalist reached its security staff. A published disclosure channel is a basic control, and its absence meant the discovery depended on a route outside the company's own processes. Once that route existed, the revocation followed, and that sequence is the part that can be repeated across other companies with similar gaps.