Business / news
Applebee's Patches App Flaw That Exposed Customer Database Password
Applebee's has fixed a security flaw in its Android app that left a database password embedded in the code, potentially giving anyone access to registered customers' personal information. The restaurant chain confirmed the fix on Thursday, days after a U.K. researcher reported the issue.
The credential was hardcoded into the source code of Applebee's Android app, which has been downloaded more than a million times on Google Play. Because the password was stored in the software itself, anyone who obtained the app could extract the key and log in to the remote customer database as an authorized user.
Robert Wiggins, a U.K.-based cybersecurity researcher at What Security, found the lapse earlier this month. He used AI tools to locate the credential, which was buried among thousands of lines of code in the app.
Applebee's confirmed on Thursday that it had taken action to address the security issue and prevent unauthorized access to its customer database. The company did not disclose how long the flaw existed or whether any customer data had been accessed before the fix.
Hardcoding credentials — storing a password or private key directly in software — is considered one of the most severe classes of security vulnerability, because the secret travels with every copy of the application distributed to users.
Applebee's is a well-known casual dining chain, and its app is used for orders, loyalty programs and account management, meaning the database behind it would hold information tied to a large pool of registered customers.