Wyndham Hotels & Resorts confirmed a cybersecurity incident after researcher Robert Wiggins found embedded credentials in their Android app that allowed access to a customer database containing personal information and login tokens, possibly affecting millions worldwide.
- Hardcoded credentials exposed customer data and login tokens.
- Potentially millions of Wyndham rewards members affected.
- Wyndham resolved the issue but disclosure details remain sparse.
What happened
Security researcher Robert Wiggins identified hardcoded administrative credentials within Wyndham’s Android app, enabling him to access an internal company database. This database contained personally identifiable information such as customer names, email addresses, Wyndham member numbers, as well as JSON Web Tokens (JWTs) that keep users logged into the app without needing to re-enter passwords.
The presence of these embedded credentials represents a severe security oversight. Hardcoded credentials are intended only for development and testing phases, but when left in released app versions, they create an exploitable backdoor. Though the database contained millions of entries, the precise number of exposed customers or how long this flaw persisted remains unknown.
Why it matters
Access to login tokens combined with personal customer information poses a significant risk. Malicious actors with these tokens can impersonate users without needing passwords, potentially accessing their accounts or conducting fraudulent transactions. Additionally, the exposed data enables highly targeted phishing campaigns, increasing danger to affected individuals.
Wyndham claims the vulnerability has been resolved and there is no evidence of unauthorized access. However, transparency about the incident is limited, with no public disclosure or detailed reports on regulatory notifications. Given the scale of Wyndham’s loyalty program—comprising 129 million members—the potential impact is substantial and could erode customer trust.
What to watch next
Attention now turns to whether Wyndham will provide further details on the breach’s scope, duration, and any steps to notify potentially affected customers. Regulatory scrutiny may follow, especially with data privacy laws requiring timely incident reporting to authorities such as the SEC or data protection agencies.
This case also highlights recurring mobile app security dangers, as similar hardcoded credential issues have appeared recently in other major companies’ apps. Organizations must improve their mobile development and security audit processes to prevent such vulnerabilities that place customer data at risk.