Wyndham Android App Hardcoded Password Poses Data Risk

On November 13, 2026, TravelDaily China reported that Wyndham Hotels Group confirmed a cybersecurity incident. Security researchers found a hardcoded password in the source code of Wyndham's Android app; the password could be used for unauthorized access to an internal database hosted by Salesforce, which contains customer names, email addresses, membership numbers and JWT tokens. The discoverers estimated that the database has millions of records, but the actual number exposed could not be verified; the report mentioned that Wyndham's membership base is about 129 million people. Wyndham said it has revoked the relevant credentials, and its security team has found no evidence of unauthorized access, but it did not say whether it will notify affected customers or report to the SEC. The incident is still developing, and there is no further information on the number of affected customers or regulatory filings.