Key Takeaways
- The prayer app Click to Pray, operated by the Pope’s Worldwide Prayer Network, contained no security controls, allowing unrestricted API access to user records.
- User IDs were sequential and lacked rate limiting, enabling attackers to harvest the entire database with simple GET requests.
- Exposed data included first and last names, email addresses, birthdates, and validation hashes stored in plain text.
- The information is sufficient for sophisticated phishing campaigns, especially given the app’s predominantly older, less‑tech‑savvy user base.
- As of July 2026 the app held roughly 720,000 accounts; even a 1 % response rate to a phishing lure could affect over 7,000 individuals.
- The researcher contacted the app’s team nine times over six months without receiving any acknowledgment or fix.
- Only after a security journalist publicized the flaw did the developers patch the vulnerabilities, though the original researcher remained uncredited.
- The incident underscores that even niche, faith‑based applications require robust security practices to protect users from real‑world harm.
Discovery of the Vulnerability
In January 2026, security researcher BobDaHacker began examining the Click to Pray mobile application, the official prayer app of the Pope’s Worldwide Prayer Network. During routine testing, he noticed that the app’s backend API responded to requests without any authentication or authorization checks. By simply appending a numeric user ID to the endpoint, he could retrieve a full profile record. Alarmed by the ease of access, BobDaHacker promptly emailed the development team nine separate times, detailing the flaw and urging immediate remediation. Despite his outreach, he received no replies and observed no changes to the service for the next six months.
Technical Flaws in the API
The core of the problem lay in the app’s API design. User identifiers were assigned sequentially starting at 1 and incremented by 1 for each new account, making it trivial to enumerate all users. Furthermore, the endpoint imposed no rate limiting, allowing an attacker to fire off thousands of GET requests in rapid succession without triggering any defensive measures. Consequently, a single automated script could sweep through the entire user base, harvesting each record with minimal effort. Adding to the insecurity, the validation hash used to confirm the legitimacy of a new signup was transmitted and stored in plain text, meaning anyone who intercepted the API traffic could verify or forge accounts with ease.
Exposed Personal Data
Through the unprotected API, BobDaHacker could extract a wealth of personally identifiable information. Each record contained the user’s first and last name, email address, and date of birth. Additional fields—such as language preferences and device metadata—were also accessible, though the core identifiers alone posed significant risk. The exposure of email addresses is particularly concerning because it enables attackers to launch targeted phishing campaigns, leveraging the perceived legitimacy of a prayer‑related communication to trick recipients into divulging credentials or financial information. The presence of birthdates further aids social engineering, allowing attackers to craft messages that reference age‑specific events or milestones.
Phishing Risks and Target Demographics
BobDaHacker emphasized that the app’s user base skews toward older individuals who may not be as familiar with online security threats. This demographic is often perceived as less vigilant about suspicious emails, making them attractive targets for cybercriminals. With a list of verified email addresses in hand, an attacker could craft convincing phishing messages that appear to originate from the Vatican or the prayer network itself, perhaps claiming a missed prayer reminder, a donation request, or an urgent spiritual update. The combination of trusted branding and personal details greatly increases the likelihood that recipients will click malicious links or divulge sensitive data, potentially leading to identity theft, financial loss, or malware infection.
Scale of Exposure and Potential Harm
By July 2026, Click to Pray had amassed approximately 720,000 registered accounts. Even if only a fraction of those users fell for a phishing attempt, the absolute number of victims could be substantial. For illustration, a conservative 1 % response rate would translate to over 7,200 individuals compromised—a figure that rivals the impact of many larger‑scale breaches when considering the potential for financial fraud and emotional distress. The researcher noted that the app’s modest install base should not be mistaken for low risk; rather, the concentration of trust‑based users amplifies the danger posed by any data leak.
Silence from the Developers
Despite BobDaHacker’s persistent attempts to engage the responsible parties, the developers of Click to Pray remained silent for six months. No acknowledgment, patch, or advisory was issued during that period, leaving the vulnerability exposed and the user population at continued risk. The lack of response highlights a troubling gaps in the organization’s incident‑response posture, especially for an entity affiliated with a global religious institution that one would expect to prioritize the safety of its followers. The silence also deprived the researcher of any recognition for his responsible disclosure efforts, a common frustration within the security community.
Media Intervention and Remediation
Frustrated by the absence of a remedy, BobDaHacker reached out to Nate Neslon, a security journalist at Dark Reading. Neslon similarly encountered radio silence when he attempted to contact the app’s team directly. After publishing a detailed exposé, the story gained traction across technology and mainstream news outlets. The public pressure generated by the article prompted the developers to finally address the flaws: they implemented proper authentication, added rate limiting to the API endpoint, and began hashing validation tokens. The fixes were deployed shortly after the article went live, although BobDaHacker received no formal thanks or acknowledgment from the organization.
Lessons Learned and Closing Thoughts
The Click to Pray incident serves as a stark reminder that no application—regardless of its purpose, size, or perceived audience—is immune to security threats. Faith‑based and nonprofit organizations must adopt the same rigorous security standards expected of commercial enterprises, including secure API design, regular penetration testing, and clear channels for responsible disclosure. Moreover, timely communication with researchers can prevent prolonged exposure and preserve trust among users. In this case, the eventual remediation averted a potentially large‑scale phishing campaign, but the episode underscores the importance of proactive vigilance: safeguarding the digital flock is as vital as tending to the spiritual one.