Wyndham rewards members’ names and login tokens sat in a database its own app could unlock

Hotel company Wyndham left a password inside its Android app that opened an internal database hosted by Salesforce, exposing member names, email addresses, member numbers and login tokens. Security researcher Robert Wiggins of What Security found the credential and said AI tools helped him scan decompiled app code for simple mistakes. Wyndham says its security teams have seen no evidence of unauthorized access.

The day in tech, in one email: TLDR is the daily newsletter with links and TLDRs of the most interesting stories in startups, tech and programming.

Get TLDR →

We may earn a commission if you sign up.

The database held millions of entries, but Wiggins could not work out an accurate count of exposed customer records. Wyndham touts about 129 million enrolled rewards members, so the exposed share of that total is unknown. The credential has since been revoked, and the company has not said whether members will be told.

A password hardcoded in the Android app

In an exclusive published Nov. 9, TechCrunch reported that Wiggins found the password embedded in the source code of the Android app. A credential placed there is considered a serious vulnerability because anyone with a copy of the app can extract it and sign in to whatever it protects. Here, it granted access to an internal company database hosted by Salesforce.

Wiggins runs What Security, a site that describes a decade of vulnerability research and disclosures to companies including Apple, Google, AT&T and Dell. The Wyndham discovery is his second hardcoded-credential find in two weeks. The earlier one, covered in TechCrunch’s Oct. 30 report on Applebee’s, involved a password in that chain’s Android app that opened a customer database; Dine Brands said its security team found no evidence of unauthorized access there either, though that investigation was described as ongoing.

Names, emails, member numbers and login tokens

The exposed fields included customer names, email addresses and Wyndham member numbers, along with login tokens in the JWT format that keep users signed in to the service. Wyndham files and documents were also reachable. A login token matters more than a name: it is the object that lets a returning app session skip the sign-in screen, and a copy in the wrong hands can stand in for the member it was issued to until it expires. Wiggins said he could not establish how many members’ records sat in the database, so the figure of millions of entries describes the size of the store, not a confirmed count of affected members.

The Applebee’s case from two weeks earlier gives a sense of what a hardcoded password can open. TechCrunch verified that finding by decompiling the app and creating a test account, and the exposed Applebee’s fields included dates of birth, phone numbers, ZIP codes, veteran status and login counts, with at least 8.5 million rewards members as of last year. Wiggins said an attacker could also have modified customer data there. The Wyndham story carries no comparable statement about editing records, and the exposed Wyndham fields are the narrower set of names, emails, member numbers and tokens.

Wyndham’s response and the questions it left open

Wiggins had no way to report the flaw to Wyndham, so he asked TechCrunch to alert the company. After TechCrunch contacted Wyndham’s cybersecurity staff, the credential was revoked. A Wyndham spokesperson said the company has taken steps to address the issue and that its security teams saw no evidence of any unauthorized access, without giving details. Michael Francess, Wyndham’s cybersecurity director, said researchers can email details of potential issues to a company address, but Wyndham would not say whether it will set up a formal vulnerability disclosure program.

The spokesperson declined to say whether Wyndham keeps server logs that would show earlier access, how long the password sat in the app, when a long-term fix will ship, whether customers will be notified, or whether U.S. regulators such as the SEC will be informed.

Wyndham’s earlier spyware exposure

This is not the first time Wyndham guest data has surfaced through a third party. In May 2024 a researcher found spyware on hotel check-in computers running the remote-access tool pcTattletale, which leaked guest records. Days later pcTattletale was itself hacked and its owner, Bryan Fleming, shut the company down; he was later convicted of making, selling and advertising unlawful spyware.

Whether anyone other than Wiggins used the password before it was revoked is the question Wyndham has not answered, and without word on server logs or exposure time, the answer is unknown. Two parts of Wyndham’s reply bear on that: the company has said only that it has taken steps and sees no evidence of unauthorized access, and it did not say how long the password was in the app, how it would know, or whether regulators will hear about it. Members will learn more only if Wyndham chooses to say so, since the exposed credential is already revoked.

This article was produced with the assistance of AI and reviewed by Morning Overview editors prior to publication.

The day in tech, in one email: Get TLDR →

We may earn a commission if you sign up.