Wyndham exposes customer data through hardcoded credential in Android app
Wyndham acknowledged a cybersecurity incident after a good-faith researcher, Robert Wiggins of What Security, found a hardcoded password in the source code of the company's Android customer app. The credential gave access to an internal database hosted on Salesforce, which held customer names, email addresses, Wyndham member numbers, customer login tokens (JWTs), and internal Wyndham files and documents. The researcher said the database had millions of entries but could not determine how many customer records were exposed. The exposed credential was revoked after TechCrunch contacted Wyndham's security staff, and the company says it has no evidence of unauthorized access. Wyndham has not said how long the credential was in the app, whether server logs exist to check for earlier access, or when a long-term fix will ship.
Detalhes técnicos
- The flaw is a hardcoded credential in the public Android app, which anyone with a copy of the app can extract and use against the associated database.
- The database stored customer login tokens (JWTs), so exposure went beyond contact data to tokens that keep sessions logged in.
- Wiggins said he used AI tools to scan decompiled app code and found the credential that way. The same researcher reported a near-identical hardcoded credential in the Applebee's app two weeks earlier.
- Wyndham has no public vulnerability reporting channel, and the spokesperson would not say whether a disclosure program is planned. Michael Francess, Wyndham's cybersecurity director, said researchers can email a security address.
Remediação
- Wyndham says the exposed credential was revoked, which cuts off access to the database. The article does not say whether the credential has been rotated for all systems or whether the app has been updated.
- Defenders with similar mobile apps should search decompiled builds for embedded secrets and rotate any credential found, including Salesforce integration credentials and token-signing material.
- Because the company cannot rule out past access, organizations should assume the exposed data may have been copied and review session and token invalidation for affected accounts.
Linha do tempo
-
Wyndham exposes customer data through hardcoded credential in Android app
ler a análise desta fonte ocultar
Wyndham acknowledged a cybersecurity incident after a good-faith researcher, Robert Wiggins of What Security, found a hardcoded password in the source code of the company's Android customer app. The credential gave access to an internal database hosted on Salesforce, which held customer names, email addresses, Wyndham member numbers, customer login tokens (JWTs), and internal Wyndham files and documents. The researcher said the database had millions of entries but could not determine how many customer records were exposed. The exposed credential was revoked after TechCrunch contacted Wyndham's security staff, and the company says it has no evidence of unauthorized access. Wyndham has not said how long the credential was in the app, whether server logs exist to check for earlier access, or when a long-term fix will ship.
Technical Details
- The flaw is a hardcoded credential in the public Android app, which anyone with a copy of the app can extract and use against the associated database.
- The database stored customer login tokens (JWTs), so exposure went beyond contact data to tokens that keep sessions logged in.
- Wiggins said he used AI tools to scan decompiled app code and found the credential that way. The same researcher reported a near-identical hardcoded credential in the Applebee's app two weeks earlier.
- Wyndham has no public vulnerability reporting channel, and the spokesperson would not say whether a disclosure program is planned. Michael Francess, Wyndham's cybersecurity director, said researchers can email a security address.
Remediation
- Wyndham says the exposed credential was revoked, which cuts off access to the database. The article does not say whether the credential has been rotated for all systems or whether the app has been updated.
- Defenders with similar mobile apps should search decompiled builds for embedded secrets and rotate any credential found, including Salesforce integration credentials and token-signing material.
- Because the company cannot rule out past access, organizations should assume the exposed data may have been copied and review session and token invalidation for affected accounts.