Password Hidden in Code, Database Exposed
Wyndham Hotels & Resorts, one of the largest hotel and resort chains in the world with approximately 8,400 properties and 25 brands — including Days Inn, La Quinta, and Ramada — suffered a data exposure as simple as it was devastating: a password written directly into the source code of the company's Android app. Security researcher Robert Wiggins of What Security found the hardcoded credential during a routine analysis and discovered it granted direct access to an internal database hosted by Salesforce, the very CRM platform Wyndham uses.
The database contained customer names, email addresses, Wyndham Rewards loyalty program member numbers (which has about 129 million registered members), and, most concerning: JWT (JSON Web Token) login tokens that keep users automatically signed into the app without needing to re-enter their passwords. The database also stored internal company files and documents.
The company's silence
What's most troubling about this case is not the vulnerability itself — hardcoded passwords are a well-known issue that any cybersecurity student would recognize — but the Wyndham's near-total lack of response. When TechCrunch reached out to the company's cybersecurity team, the credential was revoked and access blocked. A spokesperson stated the team "has taken steps to address the issue" and that "there is no evidence of unauthorized access." But the company refused to answer: how long the password had been in the app; whether it has server logs to investigate past access; whether it plans to notify affected customers; whether it will report the incident to the SEC (Securities and Exchange Commission), as public companies are required to do for major cybersecurity incidents; or whether it will establish a vulnerability disclosure program so researchers can privately report security problems.
Michael Francess, Wyndham's cybersecurity director who responded to TechCrunch's investigation, mentioned that researchers can send security issue details to security@wyndham.com. But the company did not say whether it plans to make that channel public on its website, which would be a minimum first step toward a bug bounty or disclosure program.
The role of AI in the discovery
A detail worth noting is that Wiggins used AI tools to identify the hardcoded credentials, scanning thousands of lines of decompiled Android app code for password patterns. This is not the first time he has made this kind of discovery: in October, he found a nearly identical vulnerability in the Applebee's app, also with a hardcoded password in the source code that exposed customer data.
The use of AI to scan decompiled code is a technique that is becoming increasingly accessible. Automated tools can process millions of lines of code looking for known credential patterns — strings that look like passwords, variables with obvious names like "sfPassword", JWT tokens in plaintext — much faster than any manual auditor. This means vulnerabilities that might have remained hidden for years in popular app source code are now being discovered and reported within days or weeks.
Context: Wyndham has never been strong on security
This is not Wyndham's first security incident. In 2024, researchers discovered that several Wyndham hotel check-in desks were running pcTattletale, a remote-access spyware application that leaked screenshots of guest records and booking information directly to the open web. The company behind pcTattletale, an operation led by Bryan Fleming, was subsequently hacked and its customer data databases stolen — leading to the company's closure and Fleming's criminal conviction.
Before that, Wyndham had faced multiple data breaches between 2008 and 2009 that resulted in regulatory action by the FTC (Federal Trade Commission). The chain has also invested significantly in technology modernization in recent years, including partnerships with Okta for identity management and the launch of native AI applications.
What to watch
The combination of hardcoded credentials with JWT tokens is particularly concerning, as it is not just static data that is exposed — anyone with the password can also impersonate users already signed into the system. And Wyndham's lack of transparency about its ability to investigate past access leaves a massive blind spot: it is possible that, even after the credential was revoked, data may have been copied by third parties without the company knowing.
The question is whether Wyndham will finally implement a vulnerability disclosure program or continue relying on external researchers and technology journalists to discover and alert about security flaws in its systems — a model that is unsustainable for a company that handles data for hundreds of millions of guests.
Sources: TechCrunch, ABAB News, Atlabyte
✓ Independent sources cross-checked and verified before publishing
