Hotel giant Wyndham exposed customer data after a security lapse in its mobile app, according to reporting. The company left a hardcoded credential embedded in its customer app, a flaw that allowed anyone to access customer information. The incident raises serious questions about Wyndham's security practices.
Hardcoded credentials are a well-known security weakness, and their presence in a widely distributed app is a significant oversight. The flaw meant that the credential was effectively available to anyone who examined the app, potentially opening the door to unauthorized access. It is unclear how long the vulnerability existed before being discovered.
Wyndham would not say whether it has the ability to check for any past unauthorized access to customer data. That silence is likely to frustrate customers who want to know whether their information was compromised. The company has not disclosed how many customers may have been affected.
The incident adds to a growing list of data security failures at major hospitality companies. Hotels hold sensitive customer information, including payment details and travel histories, making them attractive targets for attackers. Security experts say the episode underscores the need for companies to audit their apps for embedded credentials and other common flaws.
The disclosure comes as travelers increasingly rely on mobile apps to manage bookings, check in, and access loyalty accounts, meaning a single flaw in a widely distributed application can potentially reach a very large pool of users. Hardcoded credentials have long appeared on industry lists of avoidable coding mistakes, precisely because they can be stripped out of an app and reused by anyone who knows where to look. For Wyndham, the immediate questions center on how the credential slipped into a public-facing product, what internal review processes failed to catch it, and what steps the company is now taking to remediate the issue. Customers, meanwhile, are left weighing whether to trust that their information remained secure, with little public information to guide that judgment. The episode also highlights a broader accountability gap: when companies decline to confirm whether they can detect past unauthorized access, affected users have no clear way to assess their own exposure or take protective action.