TL;DR: A security researcher found a password hardcoded directly into Wyndham’s Android app, and that single credential opened a Salesforce-hosted database holding guest names, emails, member numbers and login tokens for a rewards program with roughly 129 million enrolled members. Wyndham says it has no evidence anyone else got in, but it won’t say how long the password sat exposed, whether it will notify customers, or whether it plans to build a real way for researchers to report problems like this one.
The researcher is Robert Wiggins, who runs a small outfit called What Security. He told TechCrunch he went digging through the source code of Wyndham’s Android app and found a password sitting in plain text, baked right into the app itself. It wasn’t protecting some throwaway feature. It unlocked an internal database hosted on Salesforce that held customer names, email addresses, Wyndham Rewards member numbers, internal files and documents, and JSON Web Tokens, the login credentials that let an app treat a request as if it already came from a signed-in customer.
Wiggins told TechCrunch the database held millions of entries and that he couldn’t pin down an exact count from what he was able to see before reporting it. Wyndham’s rewards program has about 129 million enrolled members, which gives a sense of scale even if the exposed slice turns out to be narrower than the full membership base. A JWT in the wrong hands is a particularly nasty find, since it can let an attacker act as a logged-in user without ever needing a password of their own.
Here’s the part that should embarrass Wyndham more than the bug itself: Wiggins had no official way to report it. The company had no published vulnerability disclosure page, no security.txt file, no bug bounty program, nothing that told an outside researcher where to send a warning. So he brought it to TechCrunch’s security editor Zack Whittaker instead, who contacted Wyndham directly. Only after that outside pressure did the company revoke the credential.
A Wyndham spokesperson gave TechCrunch a short statement: “Our security teams have no evidence of any unauthorized access.” That’s a narrower claim than “nothing happened,” and it depends entirely on what logs Wyndham actually kept and for how long. The company wouldn’t say whether it can review server access logs going back far enough to be sure, how long the password had been sitting in the app before Wiggins found it, whether it plans to notify affected customers, or whether it intends to file anything with the SEC, which requires public companies to disclose material cybersecurity incidents. Michael Francess, Wyndham’s cybersecurity director, did say researchers can now email the security team directly. That’s progress, if a belated one.
This is Wiggins’ second hardcoded-credential find in about two weeks. Late last month he reported a nearly identical flaw in Applebee’s app. He’s said he used AI tools to help find both bugs, and that tracks with a pattern that’s been building all year: AI-assisted code review is making it dramatically cheaper and faster to spot the kind of sloppy mistake that used to take a dedicated pentester days of manual digging. It’s the same shift we flagged when a wave of AI-built hacking tools started showing up on forums aimed at lowering the skill floor for attackers, not just defenders. The tooling cuts both ways.
Hardcoded credentials aren’t a new or exotic bug class. They’ve sat on security checklists for close to two decades, right next to SQL injection and storing passwords in plain text. A hotel chain with 129 million loyalty members shipping one in 2026 says less about sophisticated attackers and more about how little pressure large consumer brands feel to put their mobile apps through a real security review before shipping. Nobody broke in with a clever exploit chain here. Somebody just read the code Wyndham published to the Play Store.
Hospitality has a rough track record here. Marriott disclosed a breach affecting roughly 500 million guests back in 2018, and MGM Resorts lost control of its own casino floor for days during a 2023 ransomware attack. Wyndham now joins that list, even though this particular incident looks more like sloppy engineering than a targeted intrusion. Loyalty databases sit at the intersection of two things attackers love: a huge number of records and weak internal access controls, since marketing teams and app developers usually need broad read access to the same customer data that security teams are supposed to be locking down.
If you’re a Wyndham Rewards member, there isn’t much to act on yet, since the company hasn’t said whether it will notify anyone directly. The reasonable precaution is the same one that applies after any hotel-chain breach: change your Wyndham password, don’t reuse it anywhere else, and watch for phishing emails that reference real stay details, since that kind of personalization is exactly what a leaked database makes possible.
It’s also a reminder that loyalty programs have quietly become some of the richest targets in consumer tech, precisely because nobody thinks of them as sensitive. A hotel rewards database isn’t just names and email addresses. It’s stay history, in some cases payment metadata, and more than enough personal detail to build a convincing phishing email. We saw a version of the same root cause last week when a leaked credential exposed Web3Auth and Keplr wallet users to a much bigger breach than the initial bug suggested. One secret, left somewhere it shouldn’t have been, is usually all it takes.
Wyndham’s response leans hard on the careful language of corporate crisis communications: an assurance with no evidence behind it, paired with a refusal to answer the specific questions that would actually tell its members whether they’re at risk. That’s a thin shield for a company that just had an independent researcher walk through a door it left wide open in its own app.
The bottom line
A hardcoded password in a major hotel chain’s app is the kind of basic failure security teams have been warning about for twenty years, and the fact that Wyndham gave outside researchers no safe way to report it is almost as damning as the bug itself. The company moved fast once TechCrunch got involved, but “we have no evidence of unauthorized access” isn’t the same as “nothing happened,” and 129 million rewards members deserve a clearer answer than the one Wyndham gave.
The Teck Hustlers Editorial Team covers technology, business, finance and gaming news for readers who want the story behind the headline. Every article is researched, written and edited by our in-house team, checked against company announcements, filings and reputable reporting, and updated when new facts emerge. We focus on what each development means for founders, professionals, investors and everyday users. Have a tip or a correction? Reach us through our contact page.
