Wyndham app password exposed customer data in Salesforce database

Wiggins, of What Security, said the database also held login tokens that keep customers signed in to the app, along with Wyndham files and documents. It contained millions of entries, he said, though he could not establish how many customer records were exposed. Wyndham says it has about 129 million enrolled rewards members.

The company said it had “no evidence of any unauthorized access” and that its teams had addressed the issue. It did not answer questions about whether it would notify affected customers or U.S. regulators, how long the password had been in the app, or how it would prevent a recurrence. Wyndham also did not say whether it would create a formal vulnerability disclosure program. Cybersecurity director Michael Francess told TechCrunch researchers could report potential issues to security@wyndham.com.

Hardcoded credentials in public apps can be extracted and used to reach associated systems. Wiggins said he used AI tools to find the Wyndham flaw, his second public discovery of hardcoded credentials in two weeks; the first involved a similar vulnerability in Applebee’s app. He said he welcomed Wyndham’s fix but warned that, without visibility into prior activity, a malicious actor could have leaked substantial customer information.

The incident follows a separate Wyndham-related security case in 2024, when a researcher found remote-access spyware on several hotel check-in desks that was exposing screenshots of guest records and booking information online. After TechCrunch reported on it, the spyware’s creator, Bryan Fleming, was arrested by federal authorities and convicted of making, selling and advertising unlawful spyware.