Wyndham Android app password exposed customer data in Salesforce
Original title: Hotel giant Wyndham exposed customer data after app security lapse
A researcher found the password in the app source, unlocking names, emails, member numbers, login tokens, and files.
Wyndham acknowledged a cybersecurity incident after Robert Wiggins of What Security found a password in the source code of its Android app. The credential opened an internal Salesforce-hosted database with customer names, email addresses, member numbers, JWTs that keep users logged in, and company files. TechCrunch reported the finding; notification and access-log questions are unanswered.
Unconfirmed: It is unconfirmed whether anyone besides the researcher accessed the data or whether customers will be notified.
- Wiggins described the discovery to TechCrunch as a good-faith research find.
- The database stores JWTs so customers stay logged in without reentering passwords.
- Salesforce hosts the internal database the embedded password unlocked.
- Whether outsiders used the credential is not stated.
Impact: names, emails, member numbers, login tokens, and files
| Product | Affected |
|---|---|
| Wyndham Android app | — |
- Products
- Wyndham Android app
- Victims
- Wyndham
- Organizations
- SalesforceWhat Security
From the original article
2 min read at databreaches.netIt’s been a while since hotel and resort giant Wyndham has shown up on DataBreaches. net. There was one report in 2024, but prior extensive coverage involved their historic litigation with the FTC following a breach.
By Dissent · databreaches.net
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.