Wyndham Hotels: Customer Data Exposure Raises Concerns Over Android App Security

Wyndham Hotels & Resorts, one of the world's largest hospitality groups, is facing renewed scrutiny over its digital security practices after a vulnerability in its Android application exposed access to an internal database containing customer information.

The incident came to light following an investigation by cybersecurity researcher Robert Wiggins of What Security. His discovery revealed that a password had been embedded directly into the source code of Wyndham's mobile application, potentially allowing anyone who extracted the credential to connect to an internal database hosted on Salesforce.

The exposed information reportedly included customers' names, email addresses and Wyndham loyalty membership numbers. The database also contained authentication tokens, known as JSON Web Tokens (JWTs), which allow users to remain logged into their accounts without repeatedly entering their passwords.

The researcher also identified company documents and other files within the accessible database.

Millions of Database Entries Raise Concerns

Although the exact number of affected customer records remains undetermined, Wiggins reported that the database contained millions of entries. The scale of the discovery has attracted particular attention given Wyndham's extensive international customer base, with the company reporting approximately 129 million enrolled rewards members.

The potential exposure of authentication tokens adds another dimension to the incident. Unlike ordinary contact information, these digital credentials can maintain access to user accounts, making their protection particularly important.

However, there is currently no confirmed evidence that malicious actors exploited the vulnerability or accessed customer information without authorization.

Wyndham Revokes Exposed Credentials After Notification

The security weakness was addressed after TechCrunch contacted Wyndham's cybersecurity team about the researcher's findings. The company subsequently revoked the compromised credential, preventing further access through the exposed password.

In a statement, a Wyndham spokesperson said the company had taken corrective measures and that its security teams had found no evidence of unauthorized access.

Nevertheless, important questions remain unanswered. Wyndham has not clarified how long the password was present in its application, whether its systems can establish if the database was previously accessed by unauthorized parties, or whether customers whose information may have been exposed will receive individual notifications.

The company has also not specified what additional technical measures it intends to introduce to prevent similar incidents.

Hardcoded Passwords Highlight a Fundamental Security Risk

The vulnerability illustrates a well-known problem in application development: hardcoded credentials. This practice involves placing passwords or other sensitive authentication information directly into software code distributed to users.

Because mobile applications can be examined and reverse-engineered, embedding credentials in publicly distributed software creates an avoidable security weakness. Once extracted, such information can potentially provide access to systems that developers intended to keep private.

The incident also demonstrates how artificial intelligence is changing cybersecurity research. Wiggins reportedly used AI-powered tools to examine decompiled application code and identify weaknesses more efficiently.

This was his second publicly reported discovery of a similar security problem within two weeks. He had previously identified a comparable vulnerability in the mobile application of restaurant chain Applebee's, where exposed credentials also created a risk to customer information.

Responsible Disclosure Remains a Challenge

The circumstances surrounding the discovery have also raised questions about how companies communicate with independent security researchers.

Wiggins said Wyndham did not provide an easily identifiable channel for reporting security vulnerabilities, prompting him to seek assistance from TechCrunch to reach the company's cybersecurity department.

Following the incident, Wyndham cybersecurity director Michael Francess indicated that researchers could submit potential security concerns through the company's security email address.

The episode highlights the importance of establishing accessible vulnerability disclosure procedures, allowing independent experts to report technical weaknesses before they can be exploited.

Previous Security Concerns Add to the Pressure

The latest incident follows another cybersecurity-related problem involving Wyndham properties in 2024. At the time, researchers discovered remote-access spyware operating on several hotel check-in computers. The software was reportedly exposing screenshots containing guest records and reservation information online.

The recurrence of security concerns places greater emphasis on the hospitality industry's responsibility to protect the personal information collected through digital reservations, loyalty programmes and mobile applications.

As hotel operators increasingly rely on interconnected platforms and cloud-based services, securing customer databases has become an essential part of maintaining consumer confidence.

For Wyndham, revoking the exposed credential represents an immediate response, but the absence of clear answers about historical database access leaves an important issue unresolved: whether the company can establish that customer information remained protected before the vulnerability was discovered.