Hotel and resort giant Wyndham acknowledged a cybersecurity incident after a researcher discovered a hardcoded password in its Android application, according to TechCrunch.
Security researcher Robert Wiggins identified a password embedded within the source code of the Wyndham mobile app, which provided unauthorized access to an internal Salesforce database. The exposed data included customer names, email addresses, member numbers, and login tokens. While the database contained millions of entries, the exact number of affected records remains unclear. Hardcoding credentials in software is considered a significant security vulnerability, as it allows anyone to extract the password and access sensitive backend systems.
Following the report, Wyndham revoked the credential. A company spokesperson stated there is no evidence of unauthorized access but did not clarify if they possess the server logs necessary to verify this claim. The company also declined to comment on whether it would notify regulators or customers. This incident follows a 2024 security issue where spyware was found on hotel check-in computers.
Industry experts emphasize that developers should avoid hardcoding credentials to prevent such exposures. Wiggins, who utilized artificial intelligence tools to identify the flaw, noted that the lack of transparency regarding past access leaves the true extent of the potential data exposure unknown.
Source: TechCrunch
