Wyndham revokes credentials after password found in Android app — TechCrunch

Hotel and resort chain Wyndham revoked credentials embedded in its Android app after a cybersecurity researcher discovered a password in the source code. As TechCrunch reports, the password provided access to the company’s internal database hosted on the Salesforce platform.

What data may have been accessible

Researcher Robert Wiggins told the publication that the credentials could be used to access customers’ names, email addresses and Wyndham loyalty program membership numbers. The database also stored JWT login tokens, which allow users to remain signed in to apps without re-entering their password, as well as company files and documents.

According to Wiggins, the database contained millions of records, but he was unable to determine the exact number of customer records that may have been accessible. Wyndham says it has approximately 129 million registered members in its rewards program.

Wyndham’s response

Wiggins did not find a way to notify Wyndham about the vulnerability and turned to TechCrunch for help. After the publication contacted the company’s cybersecurity specialists, the credentials were revoked, ending further access to the database.

More current news is available on the UA.News Telegram channel Telegram.

A Wyndham spokesperson said the company had taken steps to address the issue and that its security teams had no evidence of unauthorized access. At the same time, the company did not answer whether it has the technical capability, including server logs, to verify access to the database before the researcher discovered the issue.

Wiggins noted that without information on prior activity, it is impossible to rule out that an attacker may have copied a significant amount of customers’ personal information. Wyndham also did not clarify whether it plans to notify customers whose data may have been accessible or how it will address the issue in the app over the long term.

Embedding passwords or other credentials in publicly available apps is called hardcoding. This approach creates a risk because someone with a copy of the app could potentially extract the password and use it to access the associated server or database.