There was a security flaw in the Vatican's official Click to Pray application that exposed personal information linked to more than 700,000 registered users, but the vulnerability remained unknown until it was detected by an independent security researcher earlier this year.
A worldwide prayer network developed by La Machi Communication for Good Causes for the Pope's Worldwide Prayer Network, Click to Pray was launched in 2019 with the endorsement of Pope Francis.
Through this service, three daily prayers are delivered as well as papal content on Android, iOS and the web as part of a digital prayer platform.
Independent researcher BobDaHacker discovered in January that API endpoints could provide information about users beyond the accounts associated with their requests. The underlying user IDs were sequentially assigned, making accessing records belonging to other registered accounts possible.
Researchers identified 719,517 registered user IDs within the affected system, which indicates how much information is contained within that system. The vulnerability was addressed by the application developers earlier this year. There was a separate vulnerability in the Click to Pray API that also affected the verification process of email addresses.
The vulnerability is not limited to user details.
This API provided the validation hash that was used to verify an account's email address, which enabled attackers to potentially verify an account's email address without accessing the inbox itself. As a result of these weaknesses, multiple points of vulnerability were identified within the application's account system, in addition to the IDOR vulnerability.
Researchers reported the vulnerability to the Pope's Worldwide Prayer Network and Click to Pray on January 3, 2026; however, no response has been received. Multiple attempts to contact relevant contacts have been made, but no response has been received. Over six months later, the issue was finally addressed after the researcher contacted a journalist, who brought the matter to the attention of the Vatican.
A number of security issues have also occurred regarding Vatican-related applications in the past. According to reports, a vulnerability in the Vatican’s Bluetooth eRosary application has exposed account verification PINs in web responses, creating a potential route for account theft.
In the latest incident, insufficient access controls highlight the risks associated with applications handling personal information.
Although the Click to Pray vulnerability was reported to have been addressed, the episode raises broader concerns regarding security testing, vulnerability reporting processes and the protection of personal data within religious and public-facing digital services. The user information exposed to the exposure was not limited to this.
Click to Pray API also suffered a separate weakness, which affected the email verification process. A vulnerability in this API allowed attackers to potentially verify an account's email address without access to the actual inbox, resulting in multiple points of vulnerability within the application's account system.
Combined with the IDOR flaw, the vulnerabilities created multiple points of vulnerability.
Researchers indicated that the vulnerability was first reported to Click to Pray and the Pope's Worldwide Prayer Network on January 3, 2026. Multiple attempts were made to contact relevant contacts, however none were received. More than six months later, the researcher contacted a journalist, who raised the issue with the Vatican. This incident is the latest in a long-standing history of security issues involving Vatican-linked applications.
A vulnerability in an application associated with the Vatican's Bluetooth eRosary app in 2019 led to the leaking of account verification PINs into web responses, resulting in the possibility of account hijacking. The latest incident illustrates the risks associated with applications handling personal information that lack adequate access controls.
Despite the fact that the Click to Pray vulnerability has reportedly been rectified, the incident raises additional concerns regarding the security testing process, vulnerability reporting processes, as well as data security within religious and public-facing digital services.
Read the original article: