Wyndham Hotels Addresses Mobile App Security Flaw That Exposed Guest Information

Wyndham Hotels & Resorts has confirmed that a security vulnerability in its Android mobile application exposed sensitive customer information, raising concerns about data protection within the hospitality industry. The flaw was discovered by cybersecurity researcher Robert Wiggins, who identified weaknesses in the application's handling of confidential authentication credentials.

According to the findings, certain security credentials had been embedded directly within the application's code, potentially allowing unauthorised access to an internal database. The exposed information included customer names, email addresses, hotel loyalty programme membership numbers and authentication tokens associated with user accounts.

Of particular concern was the exposure of authentication tokens, which could potentially enable individuals to access customer accounts without entering the corresponding passwords. Such vulnerabilities present significant risks for hotel operators, particularly as digital booking systems and loyalty programmes increasingly become central to guest services.

Following the discovery, Wyndham acknowledged the issue and confirmed that corrective measures had been implemented to address the vulnerability. The company stated that its security teams had investigated the matter and found no evidence suggesting that unauthorised parties had accessed the exposed information.

However, the precise number of customers potentially affected and the duration for which the vulnerability remained present were not disclosed.

The incident draws attention to the importance of secure application development, effective authentication systems and continuous cybersecurity monitoring in hospitality operations.

As hotels expand their reliance on mobile check-ins, digital reservations and personalised guest services, protecting customer information remains a critical responsibility. The Wyndham case underscores the need for regular security assessments and stronger safeguards across hotel technology platforms.

10-11-2026