Wyndham exposed millions of customer records via app password

Wyndham's app exposed customer data

Security researcher Robert Wiggins at What Security found a password in Wyndham's Android app source code that granted access to an internal Salesforce database containing customer information.

What information was exposed

The database contained customer names, email addresses, Wyndham member numbers, and login tokens called JWTs that keep customers logged in without re-entering passwords. It also held Wyndham files and documents.

Scale of the exposure unclear

The database had millions of entries, but Wiggins could not determine an accurate number of exposed customer records. Wyndham touts some one hundred twenty nine million enrolled rewards members.

Researcher had no official channel

Wiggins said Wyndham had no way to report security flaws, so he asked TechCrunch for help alerting the company. Soon after TechCrunch contacted Wyndham's cybersecurity staff, the exposed credential was revoked.

Wyndham claims no unauthorized access

A Wyndham spokesperson told TechCrunch the company's security teams have no evidence of unauthorized access, but would not say whether Wyndham had technical means such as server logs to determine if anyone accessed the database…

“Our security teams have no evidence of any unauthorized access”

Wyndham silent on customer notification

TechCrunch asked whether Wyndham planned to notify customers or disclose the incident to the U.S. Securities and Exchange Commission as required for material cybersecurity incidents. Wyndham would not say.

Hardcoding passwords is a critical flaw

App developers avoid including passwords in released software because anyone with a copy can extract the credential and access its associated server. Many hardcoded credential cases receive maximum vulnerability severity ratings.

Second similar discovery in two weeks

Wiggins found a near-identical hardcoded credential vulnerability in Applebee's app that exposed customer data. He used AI tools for both discoveries, which scan thousands of lines of decompiled app code to identify simple security weaknesses.

Researcher warns of potential data theft

Wiggins said he was glad Wyndham fixed the issue but noted that without visibility into past activity, someone with malicious intent could have leaked large amounts of customers' personal information before his discovery.