Wyndham Android App Leak Exposes Millions of Guest Records via Embedded Credentials

Wyndham Worldwide announced that a vulnerability in its Android app permitted unauthenticated actors to obtain personal data and active login tokens of millions of hotel guests.

The flaw originated from hard‑coded usernames and passwords baked into the app’s source code. Researchers who reverse‑engineered the binary leveraged those credentials to interrogate Wyndham’s backend APIs, pulling information such as guest names, email addresses, loyalty‑program IDs and, importantly, valid authentication tokens that grant account access without additional checks.

Although a precise count of compromised records has not been released, the analysts suggested the incident could affect a large share of Wyndham’s loyalty members, reflecting the company’s worldwide reach. The tokens exposed were active when discovered, allowing potential impersonation of users, alteration of reservations, or further collection of personal information.

Wyndham said it was notified of the problem by the independent security team and that the hard‑coded credentials were stripped from the app within days of the alert. In a public statement, the firm noted it had invalidated the compromised tokens, forced password resets for impacted accounts, and launched a thorough audit of its mobile development procedures to avoid repeat mistakes. While no signs of malicious use have surfaced publicly, the case highlights the danger of storing static secrets in client‑side code.

Analysts observe that the incident underscores a wider issue for hospitality companies that depend heavily on mobile apps to interact with guests. Regulators could examine the breach under data‑protection statutes like the GDPR or CCPA, particularly if personal information was accessed without permission. Wyndham has advised its customers to keep an eye on their accounts for any irregular activity and to use strong, unique passwords. Although the firm’s rapid response seeks to rebuild trust, the episode serves as a warning about the critical need for secure coding in a world where digital keys can open extensive caches of consumer data.