Wyndham Left a Database Password Inside Its Android App, Exposing Customer Data and Login Tokens

By Kaeleb Savon Heck

DAVAO DEL NORTE, Nov. 11, 2026 — A working database password was sitting inside Wyndham's Android app, where anyone who downloaded the app and knew how to look could have found it, according to a security researcher who says the credential opened an internal customer database hosted on Salesforce.

The hotel and resort company acknowledged a cybersecurity incident and revoked the password after being contacted, TechCrunch reported on Nov. 9. Researcher Robert Wiggins of What Security told TechCrunch the database held customer names, email addresses and Wyndham member numbers, along with login tokens that keep customers signed in to the app, and Wyndham files and documents.

Wiggins said the database contained millions of entries, but he could not determine how many customer records were exposed. Wyndham says it has some 129 million enrolled rewards members, though that figure is not a count of affected people.

"Our team has taken steps to address the issue," a Wyndham spokesperson told TechCrunch. "Our security teams have no evidence of any unauthorized access."

The company would not say whether it has the logs needed to prove that, how long the password had been in the app, whether it will notify customers or regulators, or how it plans to ship a permanent fix.

How the flaw worked

The problem is what security people call a hardcoded credential: a password written directly into software that is then handed out to the public. A mobile app is downloaded to millions of phones, and its code can be pulled apart, or decompiled, with freely available tools. Any secret inside it should be treated as public.

According to TechCrunch, the password Wiggins found granted access to an internal Wyndham database hosted by Salesforce, the cloud software company that many large businesses use to manage customer records. Nothing in the reporting suggests a flaw in Salesforce itself. The issue, as described, was that Wyndham's app carried a key to the door.

TechCrunch noted that many cases of hardcoded credentials are automatically scored with a maximum vulnerability severity rating because they are so easy to abuse.

Why the login tokens matter

Names and email addresses are the kind of data that turns up in breach after breach. The more unusual detail here is the login tokens.

The tokens, called JWTs or JSON Web Tokens, are what let a customer stay signed in to an app without typing a password every time. TechCrunch reported that the database stored these tokens. In general, a valid token can act like a temporary pass to an account, which is why companies usually treat them as sensitive. The reporting reviewed for this story does not say whether the stored tokens were still valid, how long they lasted, or whether Wyndham has invalidated them since the password was revoked.

Wyndham's statement that it has "no evidence of any unauthorized access" is not the same as evidence that nobody got in. TechCrunch asked whether Wyndham had the technical means, such as server logs, to tell whether anyone used the password before Wiggins found it. The spokesperson would not say. SC Media and TechDogs, which followed TechCrunch's report, both highlighted the same open question.

No front door for reporting bugs

Wiggins told TechCrunch that Wyndham had no way for outsiders to report security flaws, so he asked the publication to help alert the company. Soon after TechCrunch contacted Wyndham's cybersecurity staff, the credential was revoked.

Many large companies run a vulnerability disclosure program, a published way for researchers to report problems without fear of legal trouble. When there is no such channel, a good-faith researcher may struggle to get a fix, and in the meantime anyone else who finds the same flaw has no reason to report it at all.

AI is making these bugs easier to find

TechCrunch reported that this is Wiggins' second public discovery of hardcoded credentials in two weeks, after he found what TechCrunch called a near-identical vulnerability in Applebee's app that exposed customer data. Wiggins relied on AI tools for both discoveries. According to TechCrunch, those tools can scan thousands of lines of decompiled app code every second, which makes simple weaknesses like an embedded password much quicker to spot.

That cuts both ways. A researcher with AI help can find and report these problems faster, but so can a criminal. Data Theorem, a mobile app security company, made the point in a blog post about the Wyndham case titled "Hardcoded Credentials in Mobile Apps: Every Key Is Public." The basic lesson is not new, but the speed at which apps can now be searched makes old mistakes more dangerous.

Background: Wyndham and hotel security

TechCrunch described Wyndham as a hotel and resort giant, and its rewards program, at 129 million enrolled members by the company's own figure, gives the app a very large potential audience. SC Media noted that the app flaw follows a 2024 security issue in which spyware was found on hotel check-in computers.

The incident also lands in a busy few weeks for corporate data exposures. The Blindbandit Chronicle has recently covered the Amadeus breach of airline booking data, the DreamHost FTP and webmail breach, and Japan's Arara email breach, which has now grown to more than 81 million addresses. Unlike those cases, Wyndham says there is no evidence anyone actually took data, and the researcher has not claimed otherwise.

Analysis: questions Wyndham hasn't answered

The fix for this particular hole was quick. Once the right people at Wyndham heard about it, the password stopped working. But a revoked password closes the door going forward; it says nothing about who walked through it before.

There are four open questions. How long was the password in the app? Does Wyndham keep logs that would show earlier access? Were the stored login tokens still usable, and have they been cancelled? And will the company tell customers or regulators? TechCrunch asked whether Wyndham planned to disclose the incident to U.S. regulators, such as through a filing with the Securities and Exchange Commission, which requires public companies to report material cybersecurity incidents. Wyndham would not say.

Until those answers come, Wyndham members are in an uncomfortable middle ground. There is no confirmed theft, but there is also no confirmation that nothing was taken.

What customers can do now

These are general precautions, not instructions from Wyndham, which has not issued customer guidance in the reporting reviewed for this story:

• Watch for phishing: Be careful with emails or texts that mention your Wyndham Rewards number or a hotel stay, especially ones that ask you to log in through a link. Go to the app or website directly instead.
• Sign out and back in: Signing out of the Wyndham app on your devices and signing in again usually forces a fresh login token to be issued.
• Check your account: Look over your rewards balance and recent activity for anything you don't recognize.
• Use a unique password: If your Wyndham password is used anywhere else, change it on those sites.

What's next

• Disclosure decisions: Whether Wyndham notifies customers or files a regulatory disclosure is still unknown.
• A permanent app fix: Wyndham has not said how or when an updated Android app without the embedded credential will ship.
• More findings: With Wiggins reporting two similar app flaws in two weeks, more companies may find embedded secrets in their own apps, either by checking themselves or by hearing from researchers.

Sources

• TechCrunch, "Hotel giant Wyndham exposed customer data after app security lapse": https://techcrunch.com/2026/11/09/hotel-giant-wyndham-exposed-customer-data-after-app-security-lapse/
• SC Media, "Wyndham addresses security flaw in Android app": https://www.scworld.com/brief/wyndham-addresses-security-flaw-in-android-app
• TechDogs, "Wyndham Exposed Customer Data After Leaving Database Password In Android App": https://www.techdogs.com/tech-news/td-newsdesk/wyndham-exposed-customer-data-after-leaving-database-password-in-android-app
• Data Theorem, "Hardcoded Credentials in Mobile Apps: Every Key Is Public": https://www.datatheorem.com/blog/hardcoded-credentials-mobile-apps/
• The Blindbandit Chronicle, "Japan's Arara Email Breach Climbs Past 81 Million Addresses as Banks, Retailers and Cities Warn Customers": https://mrblindbandit.net/publications/arara-message-breach-81-million-email-addresses-japan/