The password sat inside Wyndham's Android app. Anyone could have pulled it out.
By Lior AharonovFounder, 7IT Solutions ·
What happened
TechCrunch reported on 9 November 2026 that a password in the source code of Wyndham's Android app opened an internal customer database hosted by Salesforce. Researcher Robert Wiggins of What Security found names, email addresses, member numbers and login tokens. Wyndham says it has no evidence of unauthorized access, and the credential was revoked after TechCrunch reached out.
Why it matters
Every app you ship is a file anyone can download and take apart. A key inside it is a key on a public billboard. Wiggins found a near-identical flaw in Applebee's app two weeks earlier, TechCrunch says.
What to do
Scan your mobile builds and repos for embedded secrets today, and rotate any you find. Then give the app a per-user token from your back end instead of a shared database password.
My take
Lior Aharonov
Founder, 7IT Solutions
If it ships in the app, it ships to the attacker. Treat every string in your build as already public.
Sources
| TechCrunch: Hotel giant Wyndham exposed customer data after app security lapse | techcrunch.com |
Researched with AI tools; every fact is checked against the linked sources.