Click To Pray app reportedly exposed data belonging to more than 700,000 users

A security researcher says the Click To Pray mobile and web application exposed personal information associated with more than 719,000 registered accounts through an unsecured application programming interface (API).

Click To Pray is operated by the Pope’s Worldwide Prayer Network and is available on iOS, Android, and the web in seven languages. The service is intended to help users participate in prayers for the Pope’s intentions.

Researcher BobDaHacker reported discovering the issue on January 3 and said the organization had not responded or fixed it by July 2026. The researcher’s account was not independently verified, and the Pope’s Worldwide Prayer Network did not respond to requests for comment cited in the original report.

Sequential IDs enabled account enumeration

The reported vulnerability is an insecure direct object reference, or IDOR. According to the researcher, the API accepted a user-supplied numeric account identifier and returned information without confirming that the requester was authorized to access it.

Because account identifiers were sequential and the endpoint reportedly lacked effective rate limiting, an attacker could potentially request records for large numbers of users by changing the ID in each request. The exposed information allegedly included first and last names, email addresses, countries, dates of birth, and account-deletion status.

If confirmed, the weakness could make the service attractive to phishing operators, particularly because messages impersonating a religious organization may appear credible to some recipients. The researcher also said that verification emails from the service triggered an email-authentication warning, potentially making legitimate messages harder to distinguish from fraudulent ones.

Signup flow raised additional concerns

The report also described a separate issue in the registration process. It alleged that the signup response included a validation hash that was reused in the account-verification link sent by email. That could potentially allow an individual who knew the value to verify an account before its legitimate owner completed the process.

There was no indication in the report that passwords or prayer activity were exposed. Organizations operating user-account APIs should enforce server-side authorization checks, avoid predictable identifiers, limit automated requests, protect verification tokens, and monitor for unusual enumeration activity.