Wyndham Left a Database Password Inside Its Android App. It Won’t Say Who Was Affected—or Whether Anyone Noticed

Wyndham has confirmed a security incident after a researcher found a hardcoded credential in its Android app that opened an internal Salesforce database containing customer names, emails, loyalty numbers, and login tokens. The company revoked the credential after TechCrunch intervened. It will not say whether it has the logs to prove no one else found it first, whether it will notify customers, or whether it will file with regulators.

The bug itself is simple enough to be embarrassing: a password written directly into the app’s source code. Anyone who downloaded the app could extract it. No exploit chain, no phishing, no zero-day—just a credential sitting in plain sight

What Was Exposed

Robert Wiggins, a UK-based researcher at What Security, discovered the credential and disclosed it exclusively to TechCrunch. The password granted access to a Salesforce-hosted internal database containing:

Customer names and email addresses.
Wyndham member numbers tied to its loyalty program.
JWTs—login tokens that keep customers signed in to their apps without re-entering passwords.
Wyndham files and documents stored in the same database.

The database had millions of entries, according to Wiggins, though he could not determine an exact count of exposed customer records. Wyndham claims roughly 129 million enrolled rewards members, which gives a sense of the potential scale.

The JWT exposure is the most dangerous detail. A valid JWT can function as a session key. If someone had extracted the credential before Wiggins did, they could potentially have accessed customer accounts without triggering a password reset or login alert.

Wyndham’s Non-Answers

Wyndham’s public statement is four sentences long, and it declines to answer nearly every question that matters.

“Our team has taken steps to address the issue. Our security teams have no evidence of any unauthorised access.”

When pressed, the company would not say:

Whether it has server logs capable of detecting prior access.
Whether it plans to notify affected customers.
Whether it will file a material incident disclosure with the SEC.
How long the password had been embedded in the app.
How it plans to ship a long-term fix.

“No evidence of unauthorized access” is a standard corporate formulation. It is not the same as “we checked and no one accessed it.” Without access logs, the first claim is unfalsifiable. Wyndham’s refusal to confirm whether those logs exist is the central transparency problem in this incident[reference:5].

The company also has no public vulnerability disclosure program. Wiggins could not find a way to report the flaw directly, so he routed the disclosure through a journalist. Wyndham’s cybersecurity director later pointed to a generic security@wyndham.com address—after the fact, not before[reference:6].

Hardcoded Credentials: A Critical Vulnerability, Not a Minor Bug

Hardcoding a password in a distributed app violates a foundational security rule: any secret shipped to a user is no longer a secret. Anyone with a copy of the app—which is everyone who downloaded it—can decompile it and extract the credential.

The weakness is catalogued as CWE-798: Use of Hard-coded Credentials. It is routinely scored at CVSS 9.8, “Critical”, because it requires no privileges, no user interaction, and no special conditions to exploit. Multiple 2026 CVEs involving hardcoded credentials carry that maximum base score.

Wyndham is not the only company making this mistake. Wiggins found a near-identical hardcoded credential in Applebee’s Android app two weeks earlier[reference:9]. That database exposed names, emails, phone numbers, dates of birth, ZIP codes, veteran status, login counts, and IP addresses from recent logins[reference:10]. Applebee’s parent company, Dine Brands, also said it found “no evidence of unauthorized access” while declining to confirm whether access logs existed[reference:11].

Incident	Data exposed	Company response	Disclosure channel
Wyndham (Nov 2026)	Names, emails, member numbers, JWTs, files	Credential revoked; no evidence of access; no customer notification confirmed	None public; researcher went through TechCrunch
Applebee’s (Oct 2026)	Names, emails, phones, DOB, ZIP, veteran status, IPs	Fixed after disclosure; investigation ongoing; no notification confirmed	None found; researcher went through TechCrunch

Two companies, two apps, the same mistake, the same non-answers. That pattern suggests an industry-wide gap in mobile app security review, not two isolated errors.

The AI-Assisted Researcher

Wiggins used AI tools for both discoveries. According to TechCrunch, the tools scour thousands of lines of decompiled app code every second, making it easier to spot simple weaknesses like hardcoded credentials.

This cuts both ways. AI lowers the cost of finding these bugs for good-faith researchers—and for attackers. A vulnerability that once required manual reverse engineering can now be surfaced at scale, across thousands of apps, in minutes. The defensive implication is blunt: secrets in client-side code will be found faster than ever before.

Wyndham’s Security History Makes This Worse

This is not Wyndham’s first security failure, and the pattern matters.

In 2024, researcher Eric Daigle found pcTattletale, a consumer-grade spyware app, running on the check-in systems of at least three Wyndham hotels in the US. The spyware continuously captured screenshots of hotel booking systems, exposing guest details and partial payment card numbers to the open internet[reference:13]. pcTattletale was later hacked, its data stolen, and its founder Bryan Fleming was arrested, pleaded guilty to federal charges, and sentenced to time served and a $5,000 fine[reference:14].

Before that, Wyndham fought the FTC over data security practices following three breaches between 2008 and 2010. The company settled in 2019 under a 20-year consent order requiring a comprehensive data security program, annual audits, franchisee compliance, and breach assessments for incidents affecting more than 10,000 card numbers.

A hardcoded database password in a consumer app is difficult to square with the spirit of a 20-year data security consent order. Wyndham has not said whether it considers this incident reportable under that order or under SEC rules.

The SEC Question

Public companies are required to disclose material cybersecurity incidents on Form 8-K Item 1.05 within four business days of determining materiality. Wyndham would not say whether it has made—or will make—such a filing.

Materiality is a judgment call, and “no evidence of unauthorized access” may support a non-material conclusion. But the company has not explained its reasoning, and the absence of confirmed access logs undermines the factual basis for that judgment. Investors and customers are left to take the claim on faith.

What This Incident Teaches

Never ship secrets in client code. If the app can read it, the user can extract it. Credentials belong on the server, behind authentication and rate limits.
“No evidence of access” is not the same as “no access.” It only means something if logs exist and were reviewed. Companies should be able to say which one they mean.
A security contact is table stakes. Wyndham had no way for a researcher to privately report the flaw. The disclosure went through a journalist. A security.txt file and a monitored inbox cost almost nothing.
AI makes simple bugs easier to find—for everyone. Hardcoded credentials were always critical. They are now easier to locate at scale, which shortens the window between shipping a secret and having it discovered.
Patterns matter. Wyndham’s 2024 spyware incident, its FTC consent order, and this hardcoded credential are separate failures, but they point to the same question about security governance.

The Bottom Line

Wyndham fixed the credential quickly once a journalist called. That is the good part. Everything after that—the refusal to confirm access logs, the silence on customer notification, the non-answer on SEC disclosure, the absence of a vulnerability reporting channel—is the part that should worry customers and regulators alike.

The bug was simple. The response is the story.