Wyndham admits exposing customer data via hardcoded app credentials

Exposed login tokens and names

Security researcher Robert Wiggins from What Security analyzed Wyndham's mobile application and discovered embedded admin credentials. These baked-in codes granted him access to an internal database containing names, emails, member IDs, and active authentication tokens. The exposed data included personally identifiable information for potentially millions of guests across the global hotel chain. Wiggins noted that these tokens allow users to remain logged in without knowing their specific passwords.

Researcher contacted media for help

Wiggins attempted to contact Wyndham directly but could not locate the correct channel to report the vulnerability. He subsequently asked the media for assistance, leading TechCrunch to reach out to the company. A Wyndham spokesperson stated that their team has taken steps to address the issue immediately after disclosure. The hotel group stressed that its security teams have no evidence of any unauthorized access prior to the fix.

Unclear scope and duration of breach

While Wiggins says the database contains millions of entries, he could not determine a more concrete number of affected individuals. Wyndham claims it has 129 million enrolled rewards members but declined to elaborate on how many were exposed. The firm additionally stated that unauthorized access showed no signs yet declined to clarify the timing of the embedded credentials. Without a proper audit of server logs, experts cannot know exactly how long the database remained vulnerable.