It was reported that Wyndham Hotels & Resorts acknowledged that hardcoded passwords were embedded in the source code of their Android customer application, potentially allowing anyone to access the internal database hosted on Salesforce. Security researcher Robert Wiggins discovered that the database contained customer names, email addresses, membership numbers, JWT tokens used to maintain login sessions, as well as internal Wyndham files and documents;

The database contains millions of records, but the actual number of exposed customers remains unconfirmed. Upon learning of the issue, Wyndham revoked the affected credentials to prevent further access and stated that its security team found no evidence of unauthorized access; however, it did not disclose whether it possesses the capability to trace historical access via server logs, nor did it respond regarding whether affected customers were notified, whether the incident was reported to U.S. regulators, how long the credentials had been exposed, or how long-term remediation would be achieved. The researcher indicated that he identified the vulnerability by analyzing decompiled application code using AI-powered tools.