D4/100
Breach · high
Wyndham exposes customer data via hardcoded credential in app
Tier D · Background noise – Good to know
Who’s exposed: Wyndham customers whose data was reachable through the customer app
Tier D because: Does not hit tech teams
Reach
Attack
Damage
Fix
Remote, no login · Secrets exposed
The Brief
- Wyndham left a hardcoded credential in its customer app, letting anyone access customer data, according to TechCrunch.
- Wyndham would not say whether it can check for past unauthorized access.
- The report is based on an exclusive TechCrunch story; no further details are given in the sources.
Why it matters
Hardcoded credentials shipped inside client apps can be extracted by anyone and used to reach backend customer data, so developers should avoid embedding secrets in distributed apps.
The checklist behind the tier
Checklist · 2 of 10 yes
| No | Hits tech teams | Judgment: a consumer hotel customer app run by a non-tech company, not developer or IT tooling. |
| No | Core infrastructure | Judgment: a single company's customer app, not widely shared infrastructure software. |
| No | Popular tool | Judgment: a single hotel brand's customer app, not a widely used framework, tool or package. |
| No | Exploited in the wild | TechCrunch reports exposure and possible access, but no observed attacks using the flaw. |
| No | Public exploit | TechCrunch does not say exploit code or a proof-of-concept was published. |
| Yes | Remote, no login | TechCrunch: the hardcoded credential was 'allowing anyone to access customer data.' |
| No | Full takeover | TechCrunch describes customer data access only, not code execution, admin rights or account takeover. |
| Yes | Secrets exposed | TechCrunch: Wyndham 'exposed customer data after app security lapse' via a hardcoded credential. |
| No | Supply chain | TechCrunch describes a hardcoded credential in its own app, not malicious code shipped through a trusted channel. |
| No | No fix yet | TechCrunch does not say whether a fix has been shipped. |
Timeline
TechCrunch reports that Wyndham exposed customer data via a hardcoded credential in its customer app
TechCrunch
Hotel giant Wyndham exposed customer data after app security lapse
Source
Hotel giant Wyndham exposed customer data after app security lapse ↗ TechCrunch · 3h ago
First seen · 1 source · Full story page · How tiers are decided