Wyndham left the key in app code

Wyndham says it has fixed a security lapse after a researcher found that its Android app contained a password in its source code, a basic mistake with unusually wide consequences when the password opens an internal customer database.

TechCrunch first reported the flaw after security researcher Robert Wiggins alerted the outlet that a credential embedded in the app could be extracted and used to reach a Wyndham database hosted on Salesforce. Wiggins said the exposed data included customer names, email addresses and Wyndham member numbers. He also told TechCrunch the database stored login tokens that keep users signed in to the app, along with company files and documents.

What is established is narrow but serious: the password was in publicly released app code, and Wyndham revoked it after being contacted. What remains unclear matters just as much. Wyndham told TechCrunch its security team had “no evidence of any unauthorized access”, but the company did not say whether it had the logging needed to tell who may have reached the database before the password was disabled. It also did not say how long the credential had been present in the app.

That leaves customers in an awkward familiar position: their information may have been exposed, the company says it sees no sign it was abused, and the public cannot yet tell how much confidence that reassurance deserves.

Hardcoded credentials are not an obscure or academic bug. If a password is shipped inside an app, anyone with a copy can pull it out and try it. Security teams avoid this for exactly that reason. The problem here is less cinematic than a “hack”, and in one sense more irritating: access may have depended on nothing more glamorous than reading the code carefully.

Wyndham would not say whether it plans to notify customers or make a filing to US regulators if the incident proves material. It also did not initially provide a public route for outside researchers to report flaws, according to Wiggins, though TechCrunch later reported that Wyndham cybersecurity director Michael Francess said researchers can send reports to a security email address.

Wyndham has roughly 129 million rewards members, but Wiggins said he could not determine how many records were in reach. That uncertainty is the whole problem. A company can close the door once someone points at it; the harder question is who noticed it was open first.