Hotel giant Wyndham exposed customer data after app security lapse

Wyndham left a hardcoded credential embedded in its customer-facing mobile app, allowing anyone who extracted it to access customer data, the hotel giant has disclosed. The company declined to say whether it has the ability to determine if unauthorized access occurred previously, leaving the scope of any exposure unclear. The lapse affects the chain's app users, though Wyndham has not specified how many records or accounts were involved. The incident highlights the persistent risk of embedded secrets in mobile software, a common source of leaks that can evade traditional perimeter defenses. What to watch next is whether Wyndham adds logging or auditing capabilities to confirm past access and whether it rotates the credential and hardens its app release process.