Wyndham Android app exposed customer data via hardcoded credential

What happened

Wyndham has acknowledged a cybersecurity incident after a security researcher found a password inside the source code of its Android app. Researcher Robert Wiggins of What Security told TechCrunch that the credential gave access to an internal Wyndham database hosted by Salesforce.

According to Wiggins, as reported by TechCrunch, the database held customer names, email addresses and Wyndham member numbers. It also held customer login tokens (JWTs) that keep users logged in to the app, plus Wyndham files and documents. He said it had millions of entries but could not determine an accurate count of exposed records. Wyndham touts some 129 million enrolled rewards members, per TechCrunch.

TechCrunch reports the researcher said Wyndham has no way to report security flaws, so he asked TechCrunch to alert the company. Soon after TechCrunch contacted Wyndham’s cybersecurity staff, the credential was revoked, preventing further access. TechRadar reports the same facts and quotes the same Wyndham statement: “Our team has taken steps to address the issue” and “Our security teams have no evidence of any unauthorized access.” TechCrunch notes the company gave no further details behind that claim.

Wyndham would not say, according to TechCrunch:

• whether it has the technical means, such as server logs, to tell if anyone accessed the database before the discovery;
• how long the password was embedded in the app;
• how it plans to ship a long-term fix;
• whether it will notify customers or disclose the incident to U.S. regulators;
• whether it will set up a vulnerability disclosure program.

TechRadar adds that it is unclear which app versions kept the credentials, and that it did not see a public disclosure or customer notice from Wyndham. TechCrunch and TechRadar both say this is the second hardcoded-credential finding by Wiggins in about two weeks, after a similar issue in the Applebee’s app. TechCrunch says he used AI tools to help find both.

Am I affected?

Not confirmed for any individual. The sources say the exposed database included data on Wyndham customers and rewards members, but the number of affected records, the exposure period and the affected app versions are not confirmed.

• You are potentially in scope if you have a Wyndham rewards account or have used the Wyndham Android app. The sources do not say which users or records were in the database.
• Wyndham says it has no evidence of unauthorized access. Neither outlet confirms whether anyone else accessed the data.
• TechRadar notes that login tokens are only useful to an attacker while they remain active, not expired or revoked. Whether Wyndham invalidated tokens is not confirmed.

What to do now

1. Watch for any notice from Wyndham. As of the reports, Wyndham had not said whether it would notify affected customers, so notification is not confirmed.
2. Be cautious with emails or messages that reference your Wyndham membership or number. TechRadar’s assessment is that exposed personal data could be used for tailored phishing lures; neither source reports that this has happened.
3. If you build mobile apps, check release builds for embedded passwords or keys. TechCrunch notes that anyone with a copy of an app can extract a hardcoded credential and use it against the associated server or database. This step is general practice drawn from that point, not a Wyndham-specific instruction.
4. To report a security issue to Wyndham, TechCrunch says its cybersecurity director, Michael Francess, stated researchers can email a security contact address. The address is obscured in the source text, so check Wyndham’s official channels for it.

Sources

• TechCrunch: Hotel giant Wyndham exposed customer data after app security lapse
• TechRadar: Wyndham confirms it exposed hotel customer data after expert finds flaw in app security