November 10, 2026 – Wyndham Hotels & Resorts has addressed a security issue involving its Android app after a researcher discovered a password embedded in the application that could provide access to an internal database containing customer information. The company says it has found no evidence of unauthorized access, but the number of potentially affected customers remains unknown.
Security researcher Robert Wiggins, associated with What Security, discovered the exposed credential while examining the Android application, according to TechCrunch’s original investigation. The password reportedly provided access to a company database hosted by Salesforce. The findings point to a problem with how Wyndham’s app handled a sensitive credential, rather than evidence that Salesforce itself was compromised.
Wiggins reported that the accessible information included customer names, email addresses, Wyndham Rewards membership numbers, and internal company files. The database also contained login tokens, which help keep users signed in without repeatedly entering their passwords. Although the researcher found millions of database entries, he could not determine how many individual customers were affected.
Following the discovery, Wiggins sought help from TechCrunch to notify Wyndham about the problem. The company’s cybersecurity team subsequently revoked the exposed credential, according to the report. A Wyndham spokesperson confirmed that the company had taken steps to address the issue and said its security team had found no evidence of unauthorized access.
However, several important questions remain unanswered. Wyndham did not specify how long the password had been embedded in the Android app or whether it had sufficient records to determine who might have accessed the database before the issue was discovered. The company also did not confirm whether affected customers would receive notifications or what additional steps it planned to take.
The problem involved a security weakness known as a hardcoded credential. This happens when developers place passwords or other sensitive access information directly inside an application. Someone who examines the app’s code may be able to retrieve those details. The MITRE Common Weakness Enumeration identifies this practice as a software security weakness because exposed credentials can allow unintended access to connected systems.
For software developers and businesses using mobile applications, the incident highlights the importance of keeping sensitive credentials outside publicly distributed apps. Companies also need to limit database access, replace exposed credentials, and maintain security records that help investigate suspicious activity. TechBonafide’s guide to API security risks in connected apps explains why strong authentication, access controls, and monitoring are important for protecting connected services.
Wyndham customers should remain careful about unexpected messages that appear to come from hotels or rewards programs. Emails containing names or membership details can appear convincing, even when the sender is not legitimate. Customers can check their accounts through Wyndham’s official website or app and avoid sharing passwords or verification codes through unfamiliar links. Anyone who has interacted with a suspicious message can follow practical steps in TechBonafide’s guide on what to do after clicking a suspicious link.
Importantly, the available information does not establish that customer records were stolen or misused by criminals. The number of potentially affected customers, the duration of the exposure, and any earlier access to the database remain unconfirmed. Further information from Wyndham would be needed to determine the incident’s full impact.
