Wyndham Security Flaw Exposed Customer Data via Hardcoded Credentials in Android App
A security researcher discovered a critical vulnerability in Wyndham's Android application where a hardcoded password allowed unauthorized access to an internal database hosted by Salesforce. The exposed data included customer names, email addresses, Wyndham member numbers, and JSON Web Tokens (JWTs) used for maintaining active user sessions. While the researcher could not confirm the exact number of affected records, Wyndham boasts approximately 129 million rewards members. Following reports from TechCrunch, Wyndham revoked the compromised credentials to prevent further access. However, the company stated it has no evidence of unauthorized access and declined to clarify if it possesses the server logs necessary to determine if malicious actors exploited the flaw prior to discovery. The incident highlights a significant lapse in secure software development practices regarding hardcoded credentials.
Topics: customer privacy cybersecurity incident data breach vulnerability disclosure