Key facts
- Researcher Robert Wiggins said a password in Wyndham's Android app code opened an internal Salesforce-hosted database.
- Wiggins said the database exposed customer names, email addresses, member numbers, login tokens, files and documents.
- Wyndham's spokesperson said its security teams have no evidence of any unauthorized access to the database.
- The credential was revoked soon after TechCrunch contacted Wyndham's cybersecurity staff, blocking further access.
- Wyndham would not say whether it had server logs to determine whether anyone accessed the database before the discovery.
Wyndham, the hotel and resort company, revoked a credential embedded in the source code of its Android app after a security researcher found it granted access to an internal database hosted by Salesforce, TechCrunch reported on November 9, 2026.
Robert Wiggins, a security researcher at What Security, told TechCrunch he found the password in the app's code. He said the credential exposed customer names, email addresses and Wyndham member numbers, and that the database also held login tokens, called JWTs, that keep customers signed in to their apps without re-entering passwords, as well as Wyndham files and documents. Wiggins said the database had millions of entries but that he could not determine an accurate count of exposed customer records. Wyndham says it has about 129 million enrolled rewards members.
Wiggins said Wyndham has no way to report security flaws and asked TechCrunch to help alert the company. Soon after TechCrunch contacted Wyndham's cybersecurity staff, the credential was revoked, preventing further access to the database.
"Our team has taken steps to address the issue," a Wyndham spokesperson told TechCrunch. "Our security teams have no evidence of any unauthorized access," the spokesperson said, without giving further details. The spokesperson would not say whether Wyndham had technical means such as server logs to determine whether anyone accessed the database before Wiggins' discovery, whether it planned to notify affected customers or file notice with the U.S. Securities and Exchange Commission, how long the password had been in the app, or how it plans a long-term fix.
Michael Francess, Wyndham's cybersecurity director who responded to the incident, told TechCrunch that researchers can alert an email address with details of potential security issues. The spokesperson would not say whether the company plans to change its website to let researchers report problems.
Hardcoding, the practice of embedding passwords or credentials in publicly released software, lets anyone with a copy of the app extract the password and use it to reach the associated server or database. Wiggins told TechCrunch he was glad Wyndham fixed the issue but said that without visibility into past activity, someone with malicious intent could have leaked large amounts of customers' personal information. He said he relied on AI tools for this discovery and for a near-identical finding in Applebee's app two weeks earlier.
TechCrunch reported that in 2024 a researcher found several Wyndham hotel check-in desks running remote-access spyware that was leaking screenshots of guest records and booking information to the open web.