On November 9, 2026, hotel group Wyndham acknowledged a security incident after a researcher found that its Android app contained a password to an internal customer database. The Wyndham customer data exposure needed no sophisticated attack: anyone with a copy of the app could pull out the key. It is a familiar mistake, and one that keeps catching large companies out.

A password sitting in the Android app's source code

According to TechCrunch, security researcher Robert Wiggins of What Security found a credential embedded in the source code of Wyndham's customer app. It unlocked an internal database hosted on Salesforce.

The exposed data included customer names, email addresses and Wyndham member numbers. The database also held JWT login tokens, which keep people signed in to the app without re-entering a password, along with company files and documents. Wiggins said it contained millions of entries but could not pin down an exact count. For scale, Wyndham advertises around 129 million enrolled rewards members.

Once TechCrunch reached Wyndham's cybersecurity team, the credential was revoked, which cut off further access to the database.

"No evidence of unauthorized access" and the questions left open

A Wyndham spokesperson said the team had addressed the issue and had no evidence of unauthorized access, but gave no detail on how that conclusion was reached. Asked whether the company keeps server logs that could show earlier access, Wyndham did not answer.

Other questions also went unanswered:

  • How long the password had been embedded in the app.
  • Whether affected customers will be notified.
  • Whether the company will report the incident to regulators such as the SEC, as public companies must for material incidents.
  • When a long-term fix will ship in the app.

Wiggins welcomed the fix but pointed out that, without visibility into past activity, someone with bad intentions could already have copied large amounts of personal data.

Why hardcoded credentials are so dangerous

Hardcoding means writing a password, API key or secret directly into code. In a mobile app, anyone can download the package, decompile it, read those strings and use them to log in to the server as if they were authorized. That is why such flaws are often scored at maximum severity.

The detection method matters too. Wiggins said he used AI tools to comb through thousands of lines of decompiled code every second. Weaknesses that once required patient manual reading can now be scanned for at scale, by researchers and attackers alike.

Applebee's was just two weeks earlier

This was Wiggins's second public find of this kind in two weeks. On October 30, 2026, TechCrunch reported that Applebee's Android app also contained a database password. The exposed data there included names, emails, dates of birth, phone numbers, ZIP codes and the IP address of each customer's latest login, and Wiggins said the credential could also have let an attacker modify records.

Neither Applebee's nor Wyndham offered a way to report security flaws, so the researcher had to go through the press. Wyndham would not say whether it will launch a vulnerability disclosure program, though its cybersecurity director said researchers can email a dedicated address. Back in 2024, spyware was also found on check-in computers at some Wyndham hotels.

What companies and dev teams should do now

This is not just a hospitality problem. Any organization with a mobile app connected to a CRM, database or internal API can make the same mistake. Start with these steps:

  1. Scan source code and release builds for passwords, API keys and tokens. Tools like GitHub secret scanning can block secrets at commit time.
  2. Keep powerful keys out of the app. Route calls through a backend, issue short-lived tokens and apply least privilege per user.
  3. Rotate keys regularly, and make sure a leaked key can be revoked immediately without republishing the whole app.
  4. Turn on access logging. Without logs you cannot answer the first question after an incident: who got in, and what did they take? The DreamHost attack that exposed login sessions shows how valuable session data is to attackers.
  5. Open a vulnerability reporting channel, such as a security email address and a public policy, so researchers can reach your engineers directly.

For customers, names, emails and member numbers are the raw material for convincing scams. Stay wary of unexpected messages and review our guide to spotting phishing emails and messages.

Key takeaways

The Wyndham case shows that a basic development error can open an entire customer database, and that being able to investigate after an incident matters as much as fixing the bug. As AI makes flaw-hunting cheaper and faster, app security checks should be a mandatory step before every release.

If your company runs mobile apps or CRM-integrated systems and wants to review its architecture, secrets management and release process, contact the Besoft team for advice.

Sources

  • TechCrunch, "Hotel giant Wyndham exposed customer data after app security lapse", November 9, 2026.
  • TechCrunch, "Applebee's exposed customers' personal data after leaving database password in app", October 30, 2026.