719,517 registered accounts — and, according to an ethical hacker, the Click To Pray app has been exposing them for months.
How the vulnerability worked: an IDOR that handed over accounts
Security researcher BobDaHacker says she discovered and disclosed an Insecure Direct Object Reference (IDOR) bug in the official prayer app of the Pope's Worldwide Prayer Network on January 3. The app assigns sequential five-digit numeric user IDs at signup, and the API endpoint GET https://api.clicktopray.org/user/users/{{id}} will return user data for any valid ID without performing authorization or ownership checks. “You ask for your own data, the server gives it to you,” BobDaHacker wrote. “You ask for someone else's data, the server gives you that too. Thou shalt not authorize, apparently.”
What data was exposed
According to the researcher, the vulnerable endpoint returned first and last names, email addresses, country, dates of birth, and a flag indicating whether the account had been deleted. Because the IDs are sequential and the platform reportedly lacks rate limiting, BobDaHacker says an attacker could enumerate every account with a simple loop: “One GET request per user. for i in range(1, 719518): scrape(). That's it. That's the exploit.” The researcher further states that the API exposes all 719,517 accounts on the prayer site.
Signup flow made verification trivially bypassable
BobDaHacker also reported that the signup endpoint, POST https://api.clicktopray.org/user/users/sign-up, returns an account's validation_hash directly in the response body. That value is the same UUID included in the email verification link, meaning an attacker who can create an account with any email address would receive the validation_hash immediately and could verify the new account before the confirmation message ever reached the mailbox.
Compounding the problem, the researcher said her email client flagged the actual verification email from Click To Pray as having failed the domain’s authentication requirements and warned it might have been spoofed or improperly forwarded. “So not only is the API leaking 700,000 email addresses that could be used for phishing, but the real emails from Click To Pray already look like phishing,” she wrote. “An attacker wouldn't even need to try hard. They could send a pixel-perfect phishing email and it would have the same level of email authentication as the real thing: none. God works in mysterious ways.”
Response status: silence from the network, continued outreach from the researcher
BobDaHacker says she disclosed the issue to the Pope's Worldwide Prayer Network on January 3 and that, as of her Friday blog, “The vulnerability is still live.” The Register reports that it reached out to the Pope's Worldwide Prayer Network and did not receive any response. The researcher — who the Register notes has previously exposed other security flaws, including a McDonald’s ordering-system issue and open controls on Pudu Robotics — said she had received no reply and was “still praying for one, too.”
What this means for older users, security teams, and the prayer network
- Older users and general public: The researcher warned many Click To Pray users are likely older and “very trusting of anything Vatican related,” making exposed email addresses and names a “phishing goldmine.” She gave a hypothetical example: an email styled as “The Holy Father requests your urgent attention” could be effective against less tech-savvy recipients.
- Technologists and security teams: The specific failures cited—lack of authorization on a user-data GET endpoint, sequential numeric IDs without rate limiting, and returning a validation_hash in signup responses—are the concrete points the researcher highlighted as enabling mass enumeration and account verification bypass.
- The Pope's Worldwide Prayer Network: The Register’s outreach received no reply, and the researcher reports no acknowledgement after her January 3 disclosure; the network's response (or lack of one) remains a central unresolved fact of the report.
The Click To Pray app is available in seven languages on iOS, Android, and at clicktopray.org and, as of July 2026, has 719,517 registered accounts. The factual record in the Register’s story rests on the researcher’s disclosure, her description of the endpoints involved, and the Register’s attempt to contact the Pope's Worldwide Prayer Network, which the outlet says went unanswered.
Whether those 719,517 accounts remain exposed depends on action by the prayer network. The researcher says she reported the issue months ago; her public account is that the vulnerability “is still live.” That unresolved claim — names, email addresses, dates of birth, and account states reachable via a simple API call — is the immediate risk the platform now faces.
Original story: The Register — Pope's official prayer app commits cardinal sin, leaks 700K+ users' info
