Wyndham hotel and resort group says customer app hardcoded credentials exposed data, company says there is no evidence of unauthorized access
Hotel and resort group Wyndham admitted a cybersecurity incident. Security researcher Robert Wiggins found a hardcoded password in the source code of Wyndham's Android app that could access the company's internal database hosted by Salesforce, thereby obtaining customers' personal information.
According to Wiggins's description to TechCrunch, the information exposed by the credential included customers' names, email addresses and Wyndham member numbers. The database also stored customer login tokens (JWTs, used to keep users signed in) as well as Wyndham files and documents. Wiggins said the database contained millions of entries, but he could not determine the exact number of customer records exposed. Wyndham publicly says its rewards program has about 129 million registered members.
A Wyndham spokesperson told TechCrunch: "Our team has taken steps to address the issue. Our security team found no evidence of unauthorized access." The company did not say whether it had technical means such as server logs to check whether anyone had accessed the database before Wiggins discovered it, nor did it say whether it planned to notify affected customers or disclose the matter to regulators such as the U.S. Securities and Exchange Commission. The spokesperson also did not say how long the password had been embedded in the app, or what the long-term remediation plan was.
After TechCrunch contacted Wyndham, the exposed credential was revoked, preventing further access. Wiggins said the company previously had no way to report security vulnerabilities and asked TechCrunch for help with notification. Wyndham's chief information security officer Michael Francess said researchers could report potential issues through a specific email address, but the company did not say whether it planned to make this channel public on its website.
This is one of Wyndham's known recent security incidents. In 2024, a researcher found remote-access spyware on front-desk computers at multiple Wyndham hotels, leaking screenshots of guest records and booking information.
Hardcoded credentials are a serious vulnerability because anyone who downloads the app can extract and use the password, just as an authorized user would log in to a remote system. Wiggins discovered an almost identical vulnerability in the Applebee's app two weeks earlier.
Original source:
Title: Hotel giant Wyndham exposed customer data after app security lapse Publisher: Zack Whittaker / TechCrunch Publication date: 2026-11-09 URL: https://techcrunch.com/2026/11/09/hotel-giant-wyndham-exposed-customer-data-after-app-security-lapse/ Source type: media report Verification status: the full text was actually read in this instance, verification date 2026-11-09; the page was publicly accessible. Supporting content: supports the discovery of hardcoded credentials, the types of exposed data (names, email addresses, member numbers, JWTs, etc.), Wyndham's response (fixed, says no evidence of unauthorized access), the lack of explanation about checking ability and notification plans, the researcher's identity, and the association with the Applebee's case.
ABAB AI Insight
Robert Wiggins is a researcher at the UK-based What Security, and over two consecutive weeks he publicly identified hardcoded credential issues: first in Applebee's Android app (reported by TechCrunch on October 30, with the app downloaded more than one million times and exposing rewards members' names, email addresses, dates of birth, phone numbers, ZIP codes, and more, with the company saying there was no evidence of unauthorized access), and then at Wyndham. He used AI tools to scan decompiled code, speeding up the identification of these simple but high-risk vulnerabilities.
Wyndham is one of the world's largest hotel franchisors, with about 8,400 hotels, 25 brands, including Days Inn, La Quinta and Ramada, and about 129 million members in its rewards program. In recent years, the company has invested heavily in technology, including working with Okta on identity management and launching Wyndham AI and a ChatGPT-native app to drive direct bookings. This incident involved a Salesforce-hosted database and exposed not only static personal data but also JWT login tokens, which could allow impersonation of already signed-in users.
The case is highly similar to the Applebee's incident: in both cases, customer-app hardcoded database credentials were found, TechCrunch verified them and the company fixed the issue, the company said there was no evidence of unauthorized access but declined to say whether logs were available to check, and it did not confirm whether customers would be notified. Wyndham also had a 2024 front-desk computer pcTattletale spyware incident, involving guest names, booking details and part of payment card numbers, as well as earlier data breaches in 2008-2009, for which the FTC once sued.
What changed in this incident is the specific exposure surface for Wyndham customer data: the app distribution itself became the channel for credential leakage, rather than only the server being compromised. Because the credential has already been publicly extractable and the company has not confirmed the ability to review historical access, the possibility of unauthorized access cannot be ruled out. The indicators to watch are whether the company adds a vulnerability disclosure program, whether it reports the matter to regulators, and whether the JWTs and member data are further abused.
ABAB News · Cognitive Law
Hardcoded credentials in a customer app are equivalent to handing the database key to every downloader.
When a company says there is "no evidence of unauthorized access" but refuses to explain its ability to check, that statement cannot be independently verified.
Finding the same type of problem in major chain apps in succession shows that basic credential management remains a weakness that AI can quickly identify.