Hotel and resort giant Wyndham has acknowledged a cybersecurity incident after a security researcher discovered a bug that allowed public access to customer personal information. The vulnerability stemmed from a password embedded directly in the source code of the company’s Android application, granting entry to an internal database hosted by Salesforce.
Hardcoded credentials exposed customer data
Robert Wiggins, a security researcher at What Security, identified the flaw in the Wyndham app. He told TechCrunch that the credential provided access to a database containing millions of entries. The exposed information included customer names, email addresses, and Wyndham member numbers. The database also stored customer login tokens, known as JWTs, which keep users logged into the app without requiring repeated password entry. Additionally, the database contained various Wyndham files and internal documents.
Wyndham reports having approximately 129 million enrolled rewards members. Wiggins was unable to determine the exact number of records exposed, but the scale of the database suggests a significant volume of data was at risk. Hardcoding passwords into software is a common mistake that developers generally avoid. It allows anyone with a copy of the app to extract the password and access the associated server or database. Such vulnerabilities often receive the highest severity rating in security assessments.
Wyndham response and lack of transparency
Wiggins noted that Wyndham had no established process for reporting security flaws. He asked TechCrunch to help alert the company. Shortly after TechCrunch contacted Wyndham’s cybersecurity staff, the exposed credential was revoked. This action prevented any further access to the database.
A Wyndham spokesperson stated that the team took steps to address the issue. The company added that its security teams found no evidence of unauthorized access. However, the spokesperson declined to say whether the company had the technical means, such as server logs, to verify if anyone accessed the database before the fix. Wyndham also refused to disclose how long the password had been embedded in the app or how it plans to implement a long-term fix.
The company has not announced plans to notify customers or report the incident to U.S. regulators like the Securities and Exchange Commission. Public companies are required to disclose material cybersecurity incidents. Wyndham also did not confirm if it plans to establish a vulnerability disclosure program to allow researchers to report issues privately.
Recent security history at Wyndham
This incident follows a previous security breach at Wyndham in 2024. A researcher found that several hotel check-in desks were running remote-access spyware. The software leaked screenshots of guest records and booking information to the open web. The spyware app, called pcTattletale, was later hacked, and its data banks were stolen. This forced the company’s owner, Bryan Fleming, to shut down the business. Fleming was later arrested and convicted of making and selling unlawful spyware.
Wiggins used AI tools to identify the hardcoded credentials in the Wyndham app. This marks his second public discovery of similar vulnerabilities in two weeks. He previously found a near-identical issue in an Applebee’s app. Wiggins expressed relief that Wyndham fixed the issue but warned that without visibility into past activity, malicious actors could have leaked customer information.
Michael Francess, Wyndham’s cybersecurity director, told TechCrunch that researchers can now alert the company at a specific email address. It remains unclear if Wyndham will update its website to facilitate these reports. The company continues to face scrutiny over its data security practices as it manages a vast customer base.
Source: TechCrunch
