Wyndham Exposed Customer Data Through a Password Hidden in Its Android App

Wyndham has acknowledged a cybersecurity incident after security researcher Robert Wiggins, of What Security, found a bug that allowed access to customers' personal information. Wiggins reported the finding exclusively to TechCrunch, which published it on November 9, 2026.

The flaw was a hardcoded credential, meaning a password written directly into the app's code. Wiggins found one in the source code of Wyndham's Android app. That password granted access to an internal company database hosted by Salesforce. The database held customer names, email addresses and Wyndham member numbers. It also stored JSON Web Tokens (JWTs), the session tokens that keep customers signed in to apps, along with Wyndham files and documents.

The database held millions of entries. The exact number of exposed customer records could not be determined. Wyndham reports about 129 million enrolled rewards members, but that figure describes its membership base, not the number of records the credential reached.

Wiggins used AI tools to identify the hardcoded credentials by scouring decompiled app code, meaning code reconstructed from the compiled app file. According to the report, this was his second public hardcoded-credentials discovery in two weeks, following a near-identical vulnerability in Applebee's app.

Wiggins told TechCrunch that Wyndham had no way to report security flaws, so he asked the outlet to help alert the company. After TechCrunch contacted Wyndham's cybersecurity staff, the exposed credential was revoked, which prevented further access to the database.

Wyndham told TechCrunch that its team had taken steps to address the issue and that its security teams had no evidence of unauthorized access. The company declined to say whether it had technical means, such as server logs, to determine whether anyone had accessed the customer database before the credential was revoked. It also declined to say whether it would notify affected customers or disclose the incident to U.S. regulators, including the SEC.

In my view, the JWTs deserve more attention than the headline credential. A leaked password exposes one entry point, but a valid session token can let an attacker act as a logged-in customer until it expires or is invalidated. Whether Wyndham can rule out that use depends on its token lifetimes and revocation practices, and the company has not described either. The "no evidence of unauthorized access" statement is only as strong as the logging behind it, which is the same question Wyndham declined to answer.

The broader context here is a recurring pattern in mobile development. Secrets embedded in app binaries can be pulled out of a decompiled APK by anyone with the right tools, and AI makes that search faster for researchers and for anyone else. The same automation is available to the teams that maintain those apps. Secret scanning in CI pipelines and regular token rotation are well-understood controls.

The reporting path is the other detail worth weighing. Wiggins said the company offered no way to report vulnerabilities, and the flaw was closed only after a journalist reached its security staff. A published disclosure channel is a basic control. Its absence meant the discovery depended on a route outside the company's own processes, and once that route existed, the revocation followed.