Wyndham's Android app held a password to a customer database. The hotel company won't say if guests will be told.

Wyndham Hotels & Resorts left a password in the code of its consumer Android app that opened an internal company database holding customer names, email addresses, Wyndham member numbers and the login tokens that keep guests signed in to the app, TechCrunch reported Monday.

Security researcher Robert Wiggins of What Security told TechCrunch he found the password inside Wyndham's Android app. It granted access to a database hosted by Salesforce that also held Wyndham files and documents. Wiggins said the database had millions of entries, but he could not determine how many customer records were exposed. Wyndham's rewards program says it has about 129 million enrolled members; that is the size of the program, not a count of affected guests.

Wiggins said Wyndham had no public way to report security flaws, so he asked TechCrunch to alert the company. Soon after TechCrunch contacted Wyndham's cybersecurity staff, the password was revoked, cutting off further access to the database, according to the report.

"Our team has taken steps to address the issue," a Wyndham spokesperson told TechCrunch. "Our security teams have no evidence of any unauthorized access." The company gave no further detail.

What Wyndham would not say is the bigger story for its guests. The company would not say whether it has server logs or other technical means to know whether anyone used the password before it was revoked. It would not say how long the password sat in the app, whether it will notify affected customers, or whether it will report the incident to the Securities and Exchange Commission or other regulators. It also did not say how it plans to fix the app itself.

There is also no public word on the login tokens. TechCrunch reported that the exposed password was revoked, but it did not say whether the customer login tokens stored in the database were revoked or reissued. If those tokens stayed valid, anyone who copied them could have kept access to guests' app sessions even after the password stopped working. Wyndham has not addressed that.

As of Monday night, Wyndham, a New York Stock Exchange-listed company based in Parsippany, New Jersey, had not filed a cybersecurity incident report with the SEC. Public companies must file one within four business days of deciding that an incident is material. Searches of breach-notice records published by the attorneys general of California, Washington, Vermont and Massachusetts turned up no Wyndham Hotels notice this year. Maine's public breach database was offline.

Michael Francess, Wyndham's cybersecurity director, told TechCrunch that researchers can report bugs to security@wyndham.com. The company would not say whether it will set up a formal vulnerability disclosure program or post a reporting channel on its website.

Wyndham's rewards app is listed on Google Play with more than 1 million installs. The listing shows an update on Nov. 4, five days before the report; there is no public indication that the update addressed the password.

The same researcher found a near-identical flaw at Applebee's less than two weeks earlier. Wiggins discovered a database password left in Applebee's Android app, which has more than a million downloads, TechCrunch reported Oct. 30. That database held customers' names, emails, dates of birth, phone numbers, ZIP codes, veteran status and recent login IP addresses, and Wiggins said the credential could also have been used to change customer records. TechCrunch said it verified that flaw using a test account. Applebee's fixed it on Oct. 29. Parent company Dine Brands said it had "not currently found any evidence of unauthorized access" and that its investigation was ongoing, and it likewise would not say whether it had logs, how long the password was exposed, or whether it would notify customers or regulators.

Wiggins used AI tools to scan decompiled app code in both cases, according to TechCrunch. Neither company had a public channel for reporting the bugs.

This is not Wyndham's first brush with exposed guest data. In 2024, spyware called pcTattletale was found on check-in computers at some Wyndham hotels, leaking screenshots of guest records.

For guests, the open question is simple: Wyndham knows whether it can tell if anyone used that password, and it isn't saying.