Skip to content
NewA calmer, faster ZeroHour
StoryData breachhigh

Wyndham revokes app password that opened Salesforce customer data

2 sources · 2 articlesFirst reported Updated ()
What's new

First merged summary.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

Wyndham revoked an Android app password that opened a Salesforce customer database and says it sees no unauthorized access.

Researcher Robert Wiggins of What Security found a password in the source of Wyndham’s Android app that opened an internal Salesforce database of customer names, emails, member numbers, login tokens, and company files. He told TechCrunch he could not count exposed records; Wyndham cites about 129 million rewards members. The database stored JWTs that keep customers logged in without re-entering passwords. After TechCrunch contacted the company, Wyndham revoked the credential. Wyndham says it has no evidence of unauthorized access but would not say how long the password was embedded, whether it can check prior access, or whether it will notify customers or regulators.

Key facts
  • Password in the Android app source unlocked a Salesforce-hosted internal database.
  • Exposed fields included names, emails, member numbers, JWTs, and company files.
  • Wyndham cites about 129 million rewards members; Wiggins could not count records.
  • Credential was revoked after TechCrunch contacted Wyndham.
  • Wyndham reports no evidence of unauthorized access; log and notice questions unanswered.
  • Wiggins said he used AI tools to scan decompiled app code.
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

What each outlet adds

beyond the shared facts
  • TechCrunch129 million members, revocation, no-access claim, AI scan, unanswered notice questions
  • DataBreaches.netWyndham acknowledged the incident; Wiggins works at What Security
Products
Wyndham Android app
Victims
Wyndham
Organizations
SalesforceWhat Security

Coverage

oldest first · one row per article · UTC
  1. · 1d ago TechCrunch · SecurityFirst report

    Wyndham exposed customer data via hardcoded password in Android app

    A researcher found a Salesforce database password in the app; Wyndham revoked it and reports no unauthorized access.

  2. · 5h ago DataBreaches.net

    Wyndham Android app password exposed customer data in Salesforce

    A researcher found the password in the app source, unlocking names, emails, member numbers, login tokens, and files.