> ## Content Index
> Fetch the complete content index at: https://blog.harshkohli.com/llms.txt
> Use this file to discover other available public pages before exploring further.

# Wyndham App Password Exposed Rewards Member Data
- URL: https://blog.harshkohli.com/wyndham-app-hardcoded-password-customer-data/
- Published: 2026-11-10T07:19:09.000Z
- Updated: 2026-11-10T07:19:09.000Z
- Description: A password left in Wyndham's Android app opened a database of member names, emails and login tokens. What Wyndham Rewards members should do now.
- Author: Harsh Kohli
- Tags: Tech News, Software

If you've got a Wyndham Rewards account, your name, email address and member number may have been sitting in a database that anyone with a copy of the company's Android app could get into. Wyndham has now shut that door, but it won't say how long it was open.

## What happened

Security researcher Robert Wiggins of What Security found a password written straight into the code of Wyndham's Android app. [TechCrunch reported](https://techcrunch.com/2026/11/09/hotel-giant-wyndham-exposed-customer-data-after-app-security-lapse/?ref=blog.harshkohli.com) on November 9 that the credential opened an internal Wyndham database hosted on Salesforce. Wiggins says it held customer names, email addresses and Wyndham member numbers, plus internal company files.

The part that bothers me most is the login tokens. The database also stored JWTs, the small tokens that keep you signed in to the app without typing your password every time. A stolen token can sometimes be used to act as that customer until it expires or gets revoked.

Wiggins couldn't pin down how many customer records were in there, only that it ran to millions of entries. For scale, Wyndham says it has about 129 million rewards members. He also told TechCrunch that Wyndham had no public way to report security bugs, so the outlet passed the details along. Soon after that, the password was revoked.

Wyndham's statement says its team "has taken steps to address the issue" and has "no evidence of any unauthorized access." What it wouldn't answer matters more. The company wouldn't say whether it keeps the logs needed to check for earlier access, how long the password was in the app, whether customers will be told, or whether it'll file a disclosure with US regulators. ([TechCrunch's post on X](https://x.com/TechCrunch/status/2119929298278625601?ref=blog.harshkohli.com) broke the story.)

## Why it matters

Putting a password inside an app you hand out to millions of people is a basic mistake. Anyone can download an Android app, unpack it and read the strings inside. That's why hardcoded credentials often get the highest severity score. Wiggins says he used AI tools to scan decompiled code for exactly this sort of slip, and this is the second time in two weeks he's gone public with one, after a near-identical flaw in Applebee's app.

That should worry every company shipping a mobile app. If one researcher can find these quickly with AI help, so can people who won't call a reporter first.

## My take: what to do if you're a Wyndham member

Nothing here points to your password or card details being exposed, and Wyndham says it saw no abuse. Still, "no evidence" from a company that won't say if it can even check isn't much comfort. Wyndham's brands run hotels in a lot of countries, India included, under names like Ramada, Days Inn, Super 8 and La Quinta, so plenty of people who've never booked a "Wyndham" hotel still have a rewards account. This is what I'd do today:

- **Sign out and back in.** Log out of the Wyndham app on your phone and sign in again. That gives you a fresh session, and if Wyndham revokes old tokens on its side, the token tied to you will stop working.
- **Change your Wyndham password.** It wasn't listed as exposed, but it costs you a minute. If you used the same password anywhere else, change it there too.
- **Check your points balance and recent activity.** Loyalty points are a favourite target because people rarely watch them. Look for redemptions or profile changes you didn't make.
- **Expect phishing.** Name, email and member number are exactly what a scammer needs for a convincing "your points are expiring" email. Don't click links in those. Open the app or type the website address yourself.

Yesterday I wrote about almost the same blunder in cars: a [default 'admin' password let hackers unlock cars](https://blog.harshkohli.com/car-app-default-admin-password-unlock/) remotely. Different industry, same lazy shortcut. The [Capcom ID breach](https://blog.harshkohli.com/capcom-id-data-breach-11-million/) from a couple of weeks back is another reminder that fixing the hole is the easy bit. Working out who got in before it was fixed is where companies tend to go quiet.

If you find a security problem at Wyndham yourself, its cybersecurity director told TechCrunch that reports can go to security@wyndham.com. I'll update this post if Wyndham starts notifying customers or files anything with regulators.