Hardcoded password in Wyndham app exposed millions of customer records

A password in the app gave access to millions of customer records

Security researcher Robert Wiggins found a password embedded directly in Wyndham’s Android app. The credential opened a back door to an internal Salesforce database packed with customer records. Names, email addresses, Wyndham member numbers and login tokens—digital keys that keep users logged in—were all exposed, TechCrunch reports. The database held millions of entries, but the exact number of affected customers is still unknown.

Wyndham revokes password but stays silent on breach warnings

Wiggins tried to warn Wyndham, but the company had no public channel for security reports. He handed the details to TechCrunch, which notified Wyndham’s cybersecurity team. Within hours, the company revoked the exposed password.

A Wyndham spokesperson told TechCrunch the credential was canceled but would not say whether the company could review server logs to see if anyone else had already accessed the data. The spokesperson also declined to answer how long the password had been sitting in the app or whether Wyndham will alert customers or regulators.

Michael Francess, Wyndham’s cybersecurity director, later told researchers they could send vulnerability details to [email protected] The company has not committed to creating a formal, public disclosure program.

Repeated security failures and the risks of hardcoded credentials

Hardcoded passwords are one of the easiest vulnerabilities to exploit. Once an app is released, anyone can decompile it, extract the password and raid the linked database. Security teams routinely assign these flaws the highest severity rating.

Wiggins used AI tools to comb through thousands of lines of decompiled app code and catch the exposed password. Two weeks earlier, he used the same method to uncover an almost identical flaw in Applebee’s Android app.

Wyndham’s latest incident is not an isolated lapse. In 2024, spyware called pcTattletale was installed on Wyndham hotel check-in desks. The software leaked screenshots of guest records and booking details. Hackers later breached pcTattletale, stole its data trove and forced the company to shut down. Its owner, Bryan Fleming, was arrested on federal charges for creating and distributing illegal spyware.

Applebee’s faced the same flaw two weeks earlier

Two weeks before the Wyndham discovery, Wiggins reported a nearly identical flaw in Applebee’s Android app. A hardcoded password there also exposed a Salesforce database containing customer records. Applebee’s parent company, Dine Brands, patched the vulnerability but did not notify affected customers or regulators, TechCrunch reported.

What this means

Lazyfounder analysis — our interpretation, not reported fact.

Hardcoded credentials turn every copy of an app into a potential backdoor. Once the code is public, anyone—from security researchers to criminals—can extract the password and raid the database. Wyndham’s silence on breach notifications leaves customers in the dark about whether their login tokens could still be exploited for account takeovers.

Key takeaways

• Millions of Wyndham customers’ data—names, emails, member numbers and active login tokens—were exposed through a hardcoded password in the company’s Android app.
• Wyndham revoked the password quickly but has no logs to confirm whether anyone else accessed the data before the fix.
• The company still lacks a formal vulnerability-reporting process, despite repeated security failures.
• This is the second time in two years Wyndham has been caught exposing sensitive customer information.

Related on Lazyfounder

• Salesforce
• Applebee’s
• Applebee’s fixes hardcoded password flaw exposing customer data