Hard‑Coded Credentials in Wyndham Android App Expose Millions of Guest Records

Wyndham Worldwide revealed that a vulnerability in its Android app permitted unauthenticated actors to obtain personal data and active login tokens of millions of hotel guests.

The flaw originated from hard‑coded usernames and passwords placed within the app’s source code. Researchers who reverse‑engineered the binary leveraged those credentials to interrogate Wyndham’s backend APIs, pulling records that contained guest names, email addresses, loyalty IDs and, importantly, active authentication tokens capable of granting account access without additional checks.

Although a precise count of compromised records has not been released, the analysts suggested that the incident may encompass a large segment of Wyndham’s loyalty members, reflecting the company’s worldwide reach. The leaked tokens were valid when discovered, allowing potential impersonation of users, alteration of reservations, or extraction of further personal information.

Wyndham acknowledged receiving the alert from the independent security group and stated that the hard‑coded credentials were stripped from the app within days of the notice. In its response, the firm said it invalidated the exposed tokens, forced password resets for impacted accounts, and launched a thorough audit of its mobile development procedures to avoid repeat mistakes. While no proof of malicious use has surfaced publicly, the case highlights the danger of storing static secrets in client‑side code.

Analysts observe that the incident underscores a wider issue for hospitality companies that depend heavily on mobile apps to interact with guests. Regulators could examine the breach under data‑protection statutes like the GDPR or CCPA, particularly if personal information was accessed without permission. Wyndham has advised patrons to watch their accounts for any irregular activity and to use robust, unique passwords. Although the firm’s rapid remediation seeks to rebuild trust, the episode remains a warning about the critical need for secure coding in a world where digital keys can expose massive amounts of consumer data.