Wyndham Exposed Customer Data Through Hardcoded App Credential

What changed

Wyndham left a hardcoded credential inside its customer app, exposing customer data to anyone able to use it. Published November 9, 2026, the report says Wyndham would not confirm whether it can determine if anyone accessed that data without authorization.

Why it matters

This is a basic security failure with an unusually awkward question attached: even after the credential is found, Wyndham may not be able to say whether it was used.

For customers, the immediate issue is exposure of their data. For Wyndham’s engineering and security teams, the harder task is reconstructing what happened when the app itself carried a reusable key. The credential’s scope, how long it was available, whether anyone exploited it and how many customers were affected remain unknown.

That uncertainty matters because fixing the app and investigating past access are separate jobs. Wyndham can remove the exposed credential, but customers still need a clear answer about whether their information was actually reached.