Breach · 3 min read
Wyndham’s Android app held a password that opened a customer database
A researcher found a credential inside Wyndham’s app that reached member names, emails, rewards numbers and login tokens. Wyndham revoked it and says it has no evidence of misuse.
Hotel and resort company Wyndham has fixed a security lapse in its Android app after a security researcher found a password inside the app that let anyone reach an internal company database. TechCrunch reported the finding on November 9.
This is an exposure: the data could be reached by anyone who found the password. Wyndham says it has no evidence anyone misused it, but it hasn’t said whether it can tell.
What was exposed
The researcher, Robert Wiggins of What Security, told TechCrunch the password was in the source code of Wyndham’s Android app and granted access to a database hosted on Salesforce. According to Wiggins, the database held:
- customer names and email addresses
- Wyndham Rewards member numbers
- customer login tokens (the codes that keep you signed in to the app without typing your password each time)
- internal Wyndham files and documents
Wiggins said the database had millions of entries but he couldn’t work out how many customers were in it. Wyndham Rewards has about 129 million members, so this isn’t a count of affected people. There’s no report of passwords, payment cards or stay histories in the database.
What Wyndham said
Wiggins said Wyndham had no clear way to report security flaws, so he asked TechCrunch to alert the company. Soon after TechCrunch contacted Wyndham, the password was revoked. “Our team has taken steps to address the issue,” a Wyndham spokesperson told TechCrunch, adding: “Our security teams have no evidence of any unauthorized access.”
Wyndham wouldn’t tell TechCrunch whether it has logs that could show if someone got in before Wiggins, how long the password was in the app, whether it will notify customers or regulators, or how it will fix the app long term.
Why this keeps happening
Putting a password directly into an app, known as hardcoding, means anyone who downloads the app can pull it out. It’s a well-known mistake, and AI tools now make it faster to find. Wiggins told TechCrunch he used AI tools to scan decompiled app code, and that this was his second such find in two weeks after a near-identical problem in Applebee’s app, which we covered in Applebee’s app held a password that opened its customer database.
What you can do
- Sign out of the Wyndham app and sign back in. Login tokens were among the exposed data. Signing in again gives you a fresh token. Whether old tokens stop working is up to Wyndham, which hasn’t said whether it reset them.
- Check your Wyndham Rewards points and recent activity. Points theft is a common target when rewards accounts are exposed. Contact Wyndham if anything looks off.
- Use a unique password for Wyndham Rewards and turn on any extra sign-in protection it offers.
- Be wary of emails about your rewards number or a “problem with your stay”. Names, emails and member numbers make phishing more convincing. Open the app or type the website address yourself.
How Frame helps
If this exposure is added to a breach catalog, add it to a verified email in Frame and Frame shows what it exposed and gives you a short checklist. Frame can also look up your verified emails in Have I Been Pwned’s breach database. Frame never collects or stores the leaked records themselves.
Related coverage
- Applebee’s app held a password that opened its customer database: the same kind of mistake, found by the same researcher two weeks earlier.
- Scam messages quote real hotel bookings after a breach at booking software maker RMS: how hotel guest data turns into convincing scams.
Sources
- TechCrunch, Hotel giant Wyndham exposed customer data after app security lapse, November 9, 2026
More stories
New posts, by email.
About once a month. Plain-language privacy notes, nothing else. I never share your address.