Hotel giant Wyndham has acknowledged a cybersecurity incident after a security researcher found a password hidden inside the source code of its Android app, a lapse that opened the door to customers' personal information. The researcher, Robert Wiggins of What Security, told TechCrunch that the password gave access to an internal company database hosted by Salesforce, and Wyndham revoked the credential only after the publication contacted its security team.

What the researcher found

Wiggins found the password embedded in the Wyndham app's code, a practice known as hardcoding, which developers are generally warned against because anyone with a copy of the software can extract the credential and use it. With it, he could reach a database holding customer names, email addresses and Wyndham member numbers, along with login tokens that keep customers signed in to their apps without repeatedly entering their passwords. The database also contained Wyndham files and documents.

According to Wiggins, the database held millions of entries, although he could not establish an exact number of exposed customer records. Wyndham says it has about 129 million enrolled rewards members, but there is no suggestion that every member's details were exposed, and the precise number affected has not been established.

Wyndham had no way to report the flaw

Wiggins told TechCrunch that Wyndham had no established channel for reporting security flaws, so he asked the publication for help in alerting the company. Soon after TechCrunch contacted Wyndham's cybersecurity staff, the exposed credential was disabled, preventing any further access to the database through it.

A Wyndham spokesperson told TechCrunch: "Our team has implemented measures to rectify the issue. Our security teams found no indication of unauthorized access." The company would not say, however, whether it had the technical means, such as server logs, to determine if anyone had accessed the customer database before Wiggins found the flaw. Its spokesperson also would not say for how long the password had been embedded in the customer app, or how Wyndham plans to ship a long-term fix.

Second such find in two weeks

For Wiggins, this is his second public discovery of hardcoded credentials in two weeks, after finding a near-identical vulnerability in the Applebee's app that exposed customer data. The pattern underlines a basic failing: passwords and credentials should never be baked into software that is distributed to the public, because the app itself becomes the key to the company's internal systems.

Wyndham's cybersecurity director, Michael Francess, responded to the incident and told TechCrunch that researchers can report potential security issues to the company. The incident is the latest in a series of cybersecurity problems faced by Wyndham in recent years.

What Wyndham customers should do

Customers who use the Wyndham app should change their account password and check their account for any activity they do not recognise. Anyone who reused the same password elsewhere should change it on those services too. Customers should also be alert to phishing messages that use their name or membership details, since that information was among the data the database held. Wyndham says it has found no evidence of unauthorised access, but it has not shown that it can rule out earlier access to the database.