The Click To Pray data leak left personal details from nearly 720,000 accounts reachable through an unsecured API, according to security researcher BobDaHacker. The app is the official prayer app of the Pope’s Worldwide Prayer Network, and the researcher said the flaw was present for more than six months after they first reported it.
BobDaHacker said they found the issue in January 2026 and emailed nine people connected to the app about the vulnerabilities. According to the researcher, no one replied and no fix appeared during the following six months. Security journalist Nate Nelson of Dark Reading later reported on the issue after also seeking comment, and the researcher said the app’s security lapses were fixed only after that coverage was published.
What data did Click To Pray expose?
BobDaHacker said the exposed records included first and last names, email addresses, birthdates and other account information. That is enough to make the database useful to scammers, even without passwords or payment data.
Email addresses tied to real names and birthdates are practical phishing material. A scammer does not need a cinematic breach to do damage; a believable email to an older or less technical user can be enough. BobDaHacker argued that the app’s likely user base made the exposure more attractive to fraudsters.
The database had almost 720,000 accounts by July 2026, according to the researcher. Even a low response rate to targeted scam emails could translate into thousands of people engaging with malicious messages. That is the boring math of bad security, and it is usually more useful to criminals than clever malware.
How did the Click To Pray API flaw work?
The failure described by BobDaHacker was basic access control. The app’s API endpoint allegedly allowed anyone to retrieve user data by entering account IDs, with no meaningful barrier stopping unauthenticated requests.
The problem was made worse because user IDs were sequential. If new accounts receive predictable numbers, an attacker can count upward through the database instead of guessing. BobDaHacker said the API also lacked rate limiting, which meant a script could send one GET request per user and collect records automatically.
The researcher also said the app exposed a validation_hash used to confirm account signups. Because that value was stored in the clear, anyone who could query the API could obtain data related to account verification. BobDaHacker also criticized the app’s verification email, saying its security issues made it resemble a phishing message even when legitimate.
Who responded to the disclosure?
According to BobDaHacker, the initial private disclosure went nowhere. The researcher said they contacted nine individuals connected to the app and received no acknowledgment. Nelson at Dark Reading also reported receiving no response when he contacted parties tied to the app.
The flaw was fixed after Dark Reading published its report, according to BobDaHacker. The researcher said they were not acknowledged by the app’s makers. There is no claim in the researcher’s account that criminals exploited the weakness before it was closed, only that the API design made broad harvesting possible while the flaw remained live.
This story draws on original reporting from Tom's Hardware.
