Vatican-Linked Prayer App Exposed 720,000 Users’ Data Due to Zero Security In January 2026, security researcher BobDaHacker uncovered critical vulnerabilities in Click To Pray, the official prayer app of the Pope’s Worldwide Prayer Network, exposing sensitive user data. The app’s API lacked basic security measures, allowing unrestricted access to personal information including names, email addresses, and birthdates simply by inputting sequential user IDs. With no rate limiting on the API, attackers could automate data harvesting, retrieving details from all 720,000 accounts as of July 2026. The app’s validation_hash was also stored in plaintext, enabling account verification via email a feature that could be exploited for phishing. Given the app’s user base, which likely includes older, less tech-savvy individuals, the exposed data presented a prime target for cybercriminals. Despite multiple attempts to alert the app’s developers, BobDaHacker received no response for six months. Only after the issue was publicized by Dark Reading in late 2026 were the vulnerabilities patched though the researcher received no acknowledgment. The incident highlights the risks of overlooked security in even niche applications, with potential consequences for thousands of users.