The Wells Fargo Mobile application 1.1 for Android stores a username and password along with account balances in cleartext which might allow physically proximate attackers to obtain sensitive information by reading application data.