Click To Pray, the official prayer application endorsed by Pope Francis and operated by the Pope’s Worldwide Prayer Network, has been found to have a critical security vulnerability that exposed user data for over 700,000 accounts. Security researcher BobDaHacker disclosed the flaw in January 2023, which remained unpatched for months despite multiple attempts to contact the organization.
The vulnerability, identified as an Insecure Direct Object Reference (IDOR), allows unauthorized access to user information through the app’s API. Specifically, the endpoint GET https://api.clicktopray.org/user/users/{id} retrieves data for any user account when provided with a valid numeric ID, without verifying the requester’s authorization. Sequential user IDs enable attackers to systematically extract all 719,517 registered accounts, including names, email addresses, countries, birth dates, and account statuses.
Additionally, the app’s account registration process presents further risks. The POST endpoint for new signups returns a validation_hash in the response, which matches the token used in email verification links. This could allow malicious actors to create accounts with arbitrary email addresses and confirm them before recipients receive the verification notice. The lack of domain authentication on official emails further complicates matters, as phishing attempts mimicking the app could appear legitimate to users.
BobDaHacker highlighted the potential for exploitation, particularly among older or less tech-savvy users who may be more susceptible to social engineering attacks. The researcher noted that attackers could leverage the exposed data to craft convincing phishing campaigns, exploiting trust in Vatican-affiliated platforms. Despite outreach to the Pope’s Worldwide Prayer Network, no response was received, leaving the vulnerability unresolved.
