A password hidden inside Wyndham’s own Android app opened the door to its customer database, and anyone who downloaded the app could have pulled it out. Security researcher Robert Wiggins found the credential in the app’s source code, and it gave access to an internal database hosted by Salesforce holding customer names, email addresses, Wyndham member numbers and login tokens. Wyndham revoked the credential soon after TechCrunch alerted the company, and says its security teams have no evidence of any unauthorized access. The problem is that Wyndham would not say whether it had the logs to tell. It is the second time in two weeks that the same researcher found a near-identical hardcoded-credential vulnerability in a major American brand’s app.
What the password opened
The credential was a database password baked into the Android app’s source code, a practice developers call hardcoding. Anyone with a copy of the app could extract it and use it to reach the database behind it. App and software developers generally avoid shipping passwords in publicly released software, and given how easily such credentials can be abused, many cases of hardcoded credentials are automatically scored with a maximum vulnerability severity rating, according to TechCrunch.
Wiggins reported that the database exposed customer names, email addresses and Wyndham member numbers, along with login tokens called JWTs that keep customers signed in to their apps without re-entering a password. It also contained Wyndham files and documents. Wiggins told TechCrunch the database had millions of entries, but he was unable to determine an accurate number of exposed customer records, so no accurate affected-customer count was established or disclosed. Wyndham touts some 129 million enrolled rewards members, but that is the size of the rewards program, not a count of people whose data was exposed. The honest framing is that millions of database entries were reachable, and the number of distinct customer records or customers was not determined.
TechCrunch did not report customer passwords or payment-card details among the exposed fields. That matters for what the risk could be: exposed login tokens could enable account access if they remained valid, and the personal information could support targeted phishing. If an exposed login token remained valid and could be reused, it might allow access without a password, and member numbers and email addresses could be misused in convincing phishing attempts.
A near-identical flaw, twice in two weeks
Wiggins found the Wyndham flaw with the same method he used in his earlier Applebee’s investigation: AI tools that scour thousands of lines of decompiled app code every second, looking for simple weaknesses like hardcoded credentials. TechCrunch published the Applebee’s story on 30 October 2026, and the Wyndham story on 9 November.
| Applebee’s (30 Oct 2026) | Wyndham (9 Nov 2026) | |
|---|---|---|
| Flaw | Hardcoded database password in the Android app | Hardcoded database password in the Android app |
| Researcher | Robert Wiggins, What Security, using AI tools | Robert Wiggins, What Security, using AI tools |
| Data reachable | Names, emails, dates of birth, phone numbers, ZIP codes, veteran status, login counts, account creation dates, last-login IPs | Names, emails, Wyndham member numbers, JWT login tokens, files and documents |
| How it was reported | No reporting channel; TechCrunch mediated | No public route before disclosure; TechCrunch mediated |
| Company line | No evidence of unauthorized access; logs unconfirmed | No evidence of any unauthorized access; logs unconfirmed |
| Affected count | Never given (8.5 million rewards enrollment is context only) | Never given (129 million rewards enrollment is context only) |
| Notification or SEC filing | Unanswered | Unanswered |
The pattern is the story. One researcher using AI tools found a near-identical rookie mistake in two major American brands’ apps in two weeks, and both companies answered the same questions: no evidence of unauthorized access (Applebee’s said it had not currently found any; Wyndham said it had none), no answer on logs, no count, no answer on notification. Before these disclosures, Wiggins found no public reporting channel at either company. Wiggins said Wyndham had no way to report security flaws, and asked TechCrunch for help alerting the company. Soon after TechCrunch contacted Wyndham’s cybersecurity staff, the exposed credential was revoked.
The questions Wyndham would not answer
Wyndham’s spokesperson told TechCrunch that the team had taken steps to address the issue, and that its security teams had no evidence of any unauthorized access. Beyond that, the company would not answer the questions that mattered. It would not say whether it had the technical means, such as server logs, to determine if anyone reached the database before Wiggins found it. It would not say whether it planned to notify customers whose information was exposed, or to disclose the incident to US regulators, such as filing notice with the US Securities and Exchange Commission, as public companies must do for material cybersecurity incidents. It would not say for how long the password had sat inside its customer app, or how it plans to ship a long-term fix. And it would not say whether it planned to set up a vulnerability disclosure program so outside researchers can privately report flaws.
Michael Francess, Wyndham’s cybersecurity director who responded to the incident, told TechCrunch that researchers can now alert the company by email with details of potential security issues. That is an email address, not a program, and it arrived only after a journalist got involved. TechRadar covered the story on 10 November. As of 12 November, no SEC filing has surfaced, and Wyndham has still not said whether it will notify customers or file with the SEC.
What should I do if I’m a Wyndham Rewards member?
If you use the Wyndham app, sign out everywhere and sign back in, then change your password and check for bookings you did not make. Watch for phishing that quotes your member number. No passwords or card details were reported among the exposed fields. Treat these steps as precautions, not a verified fix.
- Sign out of the Wyndham app on every device, then sign back in as a precaution.
- Change your Wyndham password to a new one you do not use on any other account.
- Check your Wyndham account for bookings, points changes or profile edits you did not make.
- Watch for emails or texts that quote your member number or email address and treat them with suspicion.
- Do not click links in messages about this incident; open the Wyndham app or site yourself instead.
- If Wyndham contacts you about the incident, follow its instructions and check its official channels.
These are precautionary steps. TechCrunch does not say whether Wyndham invalidated the exposed login tokens or whether changing a password would revoke them. Steps 5 and 6 are standard security practice, not instructions from Wyndham.
What to watch next
Five questions are still open. Whether Wyndham rotated or invalidated the login tokens that were exposed, and whether a password change would revoke them. Whether the company notifies customers or files with the SEC, both still unanswered. Whether Wyndham says how long the password sat inside its app, a question it declined to answer on 9 November. Whether Wyndham builds a real vulnerability disclosure program instead of an email address. And whether the Applebee’s case, which sits in the same pattern, gets a fuller accounting of its own.
This is not the first time Wyndham guest data has surfaced this way. In 2024, a security researcher found several Wyndham hotel check-in desks running remote-access spyware called pcTattletale that was leaking screenshots of guest records and booking information to the open web. The spyware app was later hacked and its banks of customer data stolen, forcing its owner, Bryan Fleming, to shut the company down. Fleming was later arrested by federal authorities and convicted of making, selling and advertising unlawful spyware. Two Wyndham-related security episodes have been reported in about two years: the 2024 discovery of pcTattletale spyware on hotel check-in desks, and the 2026 Android-app database exposure.
