Pope's Prayer App Exposes 700,000 Users Because Nobody Bothered to Check Auth
A Vatican-endorsed prayer app has been leaking the personal data of over 700,000 registered users for at least six months, after an ethical hacker reported the vulnerability and was met with complete silence.
Click To Pray is the official app of the Pope's Worldwide Prayer Network. It runs on iOS, Android, and the web, supports seven languages, and as of July 2026 has 719,517 registered accounts. Its purpose is connecting the faithful to pray for the Holy Father's intentions. Its actual function, it turns out, has also included quietly handing out user data to anyone who asked.
The researcher behind the discovery, BobDaHacker, previously exposed a free-food exploit in McDonald's ordering system and unsecured controls on Pudu Robotics' machines. She reported this flaw to the Pope's Worldwide Prayer Network on January 3rd. Six months later, no fix, no response.
"The vulnerability is still live," she wrote in a blog post this week. "Nobody has ever responded. I guess my email wasn't in their prayers."
The bug itself is an Insecure Direct Object Reference flaw, or IDOR. These are embarrassingly common and require essentially zero sophistication to exploit. When the app creates your account, it assigns you a sequential numeric ID. The API endpoint that retrieves user data accepts any valid five-digit ID and returns the corresponding account details, with no check whatsoever that the requesting user actually owns that account.
As BobDaHacker puts it: "You ask for your own data, the server gives it to you. You ask for someone else's data, the server gives you that too. Thou shalt not authorize, apparently."
The exposed data includes email addresses, first and last names, country, date of birth, and account deletion status. There's no rate limiting either, so iterating through all 719,517 accounts is a trivially simple loop. One GET request per user. That really is the entire exploit.
The privacy implications are bad enough on their own, but the demographic makes it worse. The app's user base skews older, likely less technically aware, and by definition trusting of anything that appears to come from the Vatican. BobDaHacker describes it as a "phishing goldmine" and the characterisation is hard to argue with. A spoofed email invoking the Holy Father's urgent attention, dressed up with Vatican branding, aimed at someone who downloaded a prayer app, is not a difficult social engineering scenario to picture.
And here's the kicker: Click To Pray's own emails already look like phishing. BobDaHacker's mail client flagged the real verification message for failing domain authentication checks. Separately, the signup endpoint returns the account's verification hash directly in the response body, meaning someone could register using any email address and verify the account before the actual confirmation email even arrived.
So to recap: the API leaks 700,000 email addresses ripe for targeting, the real emails from the platform fail basic authentication checks, and account verification can be bypassed entirely. An attacker running a phishing campaign against these users wouldn't need to put in much effort at all. Their emails would carry exactly the same authentication credibility as the genuine article.
The Register contacted the Pope's Worldwide Prayer Network and received no reply. BobDaHacker says she's still waiting too.