Threat watch / Vulnerability
Wyndham: a password left in the Android app opened an internal customer database
Security researcher Robert Wiggins of What Security found a password inside the source code of Wyndham's Android app that gave access to an internal company database hosted by Salesforce, TechCrunch reported on November 9, 2026. The database held customer names, email addresses, Wyndham member numbers, customer login tokens and internal files, in "millions of entries". Wyndham revoked the credential soon after TechCrunch alerted it and says its security teams "have no evidence of any unauthorized access".
- Sector
- Consumer apps & devices
- Way in
- Stolen credentials
- Product or vendor
- Wyndham app, Salesforce
- How it happened
- A password embedded in the source code of Wyndham's Android app gave access to an internal Wyndham database hosted by Salesforce, according to the researcher who found it. Wyndham would not say how long the password was in the app.[1] Checked 14 Nov 2026
- What was stolen
- No theft has been reported. The exposed data included customer names, email addresses, Wyndham member numbers, customer login tokens (JWTs) and Wyndham files and documents. Wyndham says it has "no evidence of any unauthorized access" but would not say whether it has logs to check past access.[1] Checked 14 Nov 2026
- Who was impacted
- Wyndham customers whose records sat in the database. The researcher counted "millions of entries" but could not give an accurate number of exposed records. Wyndham would not say whether it will notify customers.[1] Checked 14 Nov 2026
- Threat actor
- Not attributed
Timeline
- TechCrunch reports that researcher Robert Wiggins found a database password in Wyndham's Android app; he asked TechCrunch to alert the company because Wyndham had no way to report flaws. Wyndham revokes the credential soon after being contacted and says "Our team has taken steps to address the issue". [1]