Vatican's Official Prayer App Leaks Data of 700,000 Users for Over Six Months
A critical security flaw was found in the Vatican's official prayer app, "Click to Pray." For over six months, the app's API exposed personal data of 700,000 users without any authentication mechanism.
According to a report by Jowi Morales from Tom’s Hardware, the official app “Click to Pray,” operated by the Pope’s Worldwide Prayer Network, was found to have a critical security vulnerability. This flaw, discovered by security researcher BobDaHacker in January 2026, left the data of approximately 700,000 users exposed for over six months without being fixed.
Complete Lack of Authentication
BobDaHacker’s investigation revealed that the API endpoints of Click to Pray lacked any form of authentication. By sending a simple GET request with a specified user ID, anyone could retrieve personal information such as full names, email addresses, and dates of birth.
Even more troubling was the fact that user IDs assigned to new accounts followed a sequential numbering system. Combined with the absence of rate limits, this allowed attackers to use automated scripts to systematically scan and collect data from all user IDs.
Additionally, the validation_hash used for account verification was stored in plaintext. This meant that anyone with access to the API could misuse the hash to infiltrate users’ inboxes and fraudulently activate accounts. Researchers also noted that the format of the official confirmation emails closely resembled phishing emails, which could further confuse users.
Six-Month Lag in Fixing the Issue
After discovering the vulnerability, BobDaHacker reached out to the app developers by emailing nine relevant contacts. However, no response was received for six months, and the vulnerability remained unaddressed.
The researcher later contacted journalist Nate Nelson from the cybersecurity media outlet Dark Reading, who also attempted to reach the app’s developers but received no response. It was only after Dark Reading published a report on the issue that the vulnerability was finally fixed. To this day, BobDaHacker has not received any acknowledgment or gratitude from the app developers.
Risks for Elderly Users
Click to Pray has approximately 700,000 user accounts. BobDaHacker warned that the app’s user base likely includes many older individuals who may not be tech-savvy, making them prime targets for phishing attacks. If just 1% of the exposed email addresses fell victim to malicious phishing campaigns, over 7,200 individuals could potentially be affected.
While niche services like prayer apps may not typically attract the attention of cybercriminals, the fact that such a large user database was left unprotected for an extended period cannot be overlooked. Even in comparison to historic data breaches exposing billions of accounts, the negligence displayed in this case is alarming.
Editorial Opinion
In the short term, this case highlights the low level of security awareness in apps operated by religious organizations or non-profits. Organizations with limited development resources often deprioritize implementing authentication and API security measures. This incident serves as a stark reminder that protecting user data is essential, regardless of an app’s scale or purpose.
From a long-term perspective, the importance of adopting a zero-trust approach to API security is becoming increasingly evident. Fundamental design flaws, such as sequential user IDs and the lack of rate limits, should have been detected during code reviews or vulnerability assessments. Building a culture of incorporating security reviews into the development process is imperative across the industry.
As an editorial team, we are deeply concerned about the six-month delay between the vulnerability report and its resolution. The absence of an effective reporting mechanism and the developers’ lack of response ultimately left users exposed to risks for an extended period. Regardless of an organization’s size or sector, establishing a robust process for handling security reports will become increasingly critical moving forward.
References
- ” Security flaw in Vatican’s ‘Click to Pray’ app leaves over 700,000 global users exposed — app has been leaking user data for over six months and still does ”, by Jowi Morales — Tom’s Hardware, 2026-07-25T17:56:07.000Z (ARR)
- Source URL: https://www.tomshardware.com/tech-industry/cyber-security/security-flaw-in-vaticans-click-to-pray-app-leaves-over-700-000-global-users-exposed-app-has-been-leaking-user-data-for-over-six-months-and-still-does
Frequently Asked Questions
- How was this vulnerability discovered?
- Security researcher BobDaHacker discovered it in January 2026. The API endpoints lacked authentication, allowing anyone to retrieve personal data via a single GET request with a user ID. The researcher immediately reported the issue to the developers, but no response was received for six months.
- What data was potentially exposed?
- The exposed data included full names, email addresses, and dates of birth. Additionally, the plaintext storage of the validation_hash used for account verification allowed anyone with API access to fraudulently activate user accounts.
- What steps should users take to protect themselves?
- Users should be cautious of any emails related to the app and avoid clicking on suspicious links. They should also watch out for phishing emails impersonating Click to Pray, change passwords, and enable two-factor authentication where possible.
Comments