Wyndham Exposed Customer Data via Hardcoded Credential in Mobile App

Image: TechCrunch · Source

Wyndham Hotels revealed that an embedded password in its Android app gave access to a Salesforce-hosted customer database. The company fixed the issue but disclosed no evidence of unauthorized access or plans for customer notification.

Hospitality giant Wyndham Hotels faced a cybersecurity incident after a security researcher discovered a significant vulnerability within the company's Android mobile application. Researcher Robert Wiggins from What Security found a hardcoded password embedded in the app's source code, allowing unrestricted access to an internal database hosted by Salesforce.

This exposed database contained a vast amount of sensitive customer information, including names, email addresses, Wyndham rewards member numbers, and login tokens (JWTs) that maintain user sessions without repeated password prompts. Beyond customer data, it also housed various internal files and documents. Although the precise number of records exposed remains undetermined, the database reportedly contains millions of entries; Wyndham claims to have approximately 129 million rewards members.

Upon being informed through TechCrunch, Wyndham's cybersecurity team promptly revoked the exposed credential, thereby blocking further unauthorized access. A company spokesperson confirmed the issue was addressed but did not provide details on how long the vulnerability existed or whether any data breaches occurred prior to its discovery.

Further inquiries yielded no information on whether Wyndham possesses the technical capacity, such as server logs, to investigate potential previous unauthorized access. The company also declined to confirm whether it intends to notify impacted customers or report the incident to U.S. regulators, including the Securities and Exchange Commission, as is customary for material cybersecurity events affecting public companies.

The practice of embedding credentials directly into publicly released software, known as hardcoding, is widely regarded as a severe security lapse due to the ease with which attackers can exploit such information. Wiggins noted that this finding comes shortly after he identified a comparable vulnerability in the Applebee's app using AI-assisted analysis of decompiled code, which highlights the increasing role of artificial intelligence in uncovering security weaknesses.

Wyndham also currently offers no official vulnerability disclosure program but maintains an email contact for potential security reports. Past security incidents involving Wyndham include a 2024 case where spyware on hotel check-in computers exposed guest information, ultimately leading to legal action against the spyware's operator.

This episode underscores ongoing challenges faced by large hospitality organizations in safeguarding massive databases of customer data, emphasizing the critical need for secure app development practices and transparent security incident management.