Security researcher Robert Wiggins found a credential in Wyndham’s Android app that opened a Salesforce-hosted database of customer information. Zack Whittaker reports that the credential was revoked after TechCrunch contacted Wyndham. A credential shipped in a public app can be copied by anyone who obtains the app; server-side access must be restricted independently of the app.
Evidence status: researcher-reported access and vendor-acknowledged remediation, not confirmed malicious data theft. Wiggins said he saw names, email addresses, Wyndham member numbers and customer login tokens, which can keep people signed in. He also saw files and documents in the database. He described millions of entries but could not count affected customer records. Wyndham told TechCrunch it has “no evidence of any unauthorized access,” without explaining whether it had the logs to check for earlier access.
What is known about exposure
The exposed path depended on a credential embedded in the Android app and still valid at the database. Wyndham says it revoked that credential. It did not tell TechCrunch how long the credential had been present, whether customer tokens were invalidated or how it will prevent a replacement credential being extracted from future app releases. The company’s total rewards membership is not a count of records reached through this flaw.
For operators, the supported response is to remove service credentials from distributable app builds, revoke exposed credentials on the server, narrow the service account’s database permissions and review access logs where available. Assess whether exposed session tokens need invalidation; simply revoking the database password does not itself invalidate customer sessions. Wyndham has not published customer-specific instructions in this reporting, so patrons should watch for an official notice rather than assume their own account was accessed.
Caveat: The researcher’s inspection establishes that data was reachable; the public record does not establish whether anyone else accessed it or how many customers were affected.