Vatican prayer app exposed names and emails of 700,000+ users

Vatican digital prayer platform Click To Pray left the names and email addresses of hundreds of thousands of users exposed for months, a white hat hacker has discovered.

Security researcher BobDaHacker said that she first discovered and reported the security flaw on January 3rd, 2026. Six months later, the vulnerability remained unfixed – and she had never received a response.

The app is available on iOS, Android, and clicktopray.org in seven languages. According to the Google Play description, it offers “three brief moments of prayer each day which invite you to meet with Jesus and pray for the intentions of the Holy Father.”

Click To Pray had 719,517 registered accounts at the time of testing in July, according to the researcher's disclosure.

The vulnerability was a simple security bug. Upon registering, each user is assigned a sequential numeric ID. The API endpoint returned data for any user account when supplied with an ID, with no authorization or ownership validation required.

A user could input any other sequential ID and get someone else’s data – this type of security flaw is known as Insecure Direct Object Reference (IDOR). The system never checked whether a user is allowed to access the data they are requesting – it handed it to them simply because they supplied a valid user ID.

The stored information that an unauthorized user could access included users’ email addresses, first and last names, country, dates of birth, role, and whether the account had been deleted.

“With sequential user IDs and no rate limiting, an attacker could enumerate every single account on the platform. All 719,517 of them,” BobDaHacker wrote, noting that many of the users are likely older or less tech-savvy and may fall victim to subsequent phishing or social engineering attacks.

“Imagine getting an email that says 'The Holy Father requests your urgent attention' with a Vatican-looking link. Grandma is clicking that. Every time,” she said.

But there is more.

BobDaHacker also spotted an email verification issue. She noticed that the app returned the same verification token in its API response that it later sent by email. This means that any user could verify their account without ever accessing the email inbox, which defeats the whole purpose of email verification.

Finally, the researcher said that Click To Pray had an email authentication issue. Their SPF, DKIM, or DMARC appeared misconfigured, which made their emails look like phishing. So both theirs and an attacker’s emails would be indistinguishable.

“An attacker wouldn't even need to try hard. They could send a pixel-perfect phishing email and it would have the same level of email authentication as the real thing: none. God works in mysterious ways,” she noted.

BobDaHacker disclosed the vulnerability to nine people on January 3rd, including the general info address, six individual staff members at clicktopray.org, and two contacts at popesprayer.va. She has received no response.

The Pope's Worldwide Prayer Network, which operates Click To Pray, also never responded to requests for comment.

On Friday, the ethical hacker posted an update saying the vulnerability had finally been patched following a report published by Dark Reading. Now, if you request another user's profile, you would receive public profile information, such as their first and last names, so all sensitive data (email, birth date, country, etc.) is no longer exposed.

Although the researcher never got an acknowledgement or a response, she is happy with the fix: “Still, they fixed it, and they fixed it right. That was the point. Amen.”