Wyndham exposed customer data via hardcoded password in Android app
Original title: Hotel giant Wyndham exposed customer data after app security lapse
A researcher found a Salesforce database password in the app; Wyndham revoked it and reports no unauthorized access.
Researcher Robert Wiggins found a password in the source of Wyndham’s Android app that opened an internal Salesforce database of customer names, emails, member numbers, login tokens, and company files. He could not count exposed records; Wyndham cites about 129 million rewards members. After TechCrunch contacted the company, the credential was revoked. Wyndham says it has no evidence of unauthorized access but would not say whether it can check prior access or will notify customers or regulators.
Unconfirmed: Wyndham says it has no evidence of unauthorized access but would not confirm it can detect prior access or how many records were exposed.
- The database stored JWTs that keep customers logged in without re-entering passwords.
- Wyndham would not say how long the password was embedded in the app.
- Wiggins said he used AI tools to scan decompiled app code.
- Wyndham’s cybersecurity director said researchers can report issues by email.
Impact: Names, emails, member numbers, login tokens, and files exposed
| Product | Affected |
|---|---|
| Wyndham Android app | — |
- Products
- Wyndham Android app
- Victims
- Wyndham
- Organizations
- SalesforceWhat Security
From the original article
3 min read at techcrunch.com
Exclusive: Wyndham left a hardcoded credential in its customer app, allowing anyone to access customer data. The hotel giant wouldn't say if it has the ability to check for any past unauthorized access.
By Zack Whittaker · techcrunch.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.