Wyndham Android app password exposed customer data in Salesforce
A researcher found the password in the app source, unlocking names, emails, member numbers, login tokens, and files.
Stories per day · 30 days
1 RSS
Relatedandroid3customer-data3salesforce2wyndham2apache-iotdb1applebees1authentication-bypass1connected-car1cve-2026-1076561dine-brands1earthrover1firmware1fortinet1fortisandbox1frodobots1iot1mqtt1privilege-escalation1
19 stories, newest first · one card per story
Stories tagged #hardcoded-credentials
FrodoBots EarthRover Mini+ firmware flaws enable remote root control
Hard-coded AWS and MQTT credentials enable fleet-wide root commands; the vendor says fixes are in the latest firmware.
1
Tata Motors iRA app contains hardcoded credentials
CERT-In reports flaws in Tata Motors connected vehicle apps that enable credential extraction and unauthorized access.
1
Applebee’s Android app held a database password exposing customer data
Dine Brands says it found no unauthorized access, but would not say whether database logs exist.
1
Apache IoTDB legacy pipe lets SYSTEM users act as root (CVE-2026-59229)
Versions 2.0.0 before 2.0.11 run load and delete operations with a hardcoded root identity.
ZDI-26-771: Fortinet FortiSandbox login_user_profile Hard-Coded Credentials Authentication Bypass Vulnerability
ZDI discloses an unauthenticated hard-coded credential bypass in Fortinet FortiSandbox, CVE-2026-107656 (CVSS 7.3).
Red Lion Controls N-Tron 700 Series
CISA says Red Lion N-Tron 700 switches through firmware 3.11.0 have hardcoded credentials and authentication flaws.
Dell CSM Flaws Enable Unauthenticated Admin Access and Root on Kubernetes Nodes
Dell patched six critical Container Storage Modules flaws, including two unauthenticated CVSS 10.0 bugs.
Armatura LLC Armatura One
CISA warns Armatura One embeds a critical unauthenticated ActiveMQ flaw that can remotely execute code.
Anjvision YSSD-RTMP-H5
CISA warns Anjvision YSSD-RTMP-H5 firmware has nine flaws, including unauthenticated access and command injection.
Viidure Dashcam Android Application
CISA reports Viidure dashcam cloud storage is publicly readable and the app embeds full-access credentials.
[0day-rubbish] Server Technology PRO3X PDU 030600 port_mux listener program override to root command execution (7.2)
0day Rubbish disclosed authenticated root command execution in Server Technology PRO3X PDUs on firmware 030600.
HPE Networking ALE Flaws Let Hackers Bypass Security Controls and Compromise Systems
HPE fixed critical unauthenticated flaws in Networking ALE that enable credential abuse and arbitrary file writes.
Eufy Omni C20, Omni X10 Pro
CISA warns Eufy Omni C20 and X10 Pro versions before 1.6.4 have command injection and certificate flaws.
HPE Networking Analytics Engine Flaws Let Attackers Gain Root Access
HPE patched ten Analytics Engine flaws, including unauthenticated bugs that can give attackers root.
Bransys ELD
CISA reports Bransys ELD apps ship hardcoded MQTT and FTP credentials plus cleartext transport, exposing real-time telemetry for connected fleet devices.
Flock cameras are riddled with security vulnerabilities and hardcoded creds
Leaked Flock ALPR camera firmware reveals EOL Android 8.1, a 2017 Linux kernel, and hardcoded API keys granting access to production credentials.
Local Privilege Escalation (LPE) in FolkPatch due to Hardcoded Default SuperKey
A hardcoded default SuperKey in FolkPatch, an APatch-based kernel patching tool, enables local privilege escalation limited to FolkPatch's downstream code.
Tycon Systems TPDIN-Monitor-WEB3
CISA reports three flaws (hard-coded credentials, CSRF, missing authorization) in Tycon TPDIN-Monitor-WEB3 <=2.2.9 enabling MitM, credential theft, or device resets.
1