Vatican prayer app data breach

In early January 2026 a security researcher (BobDaHacker) identified an insecure direct object reference (IDOR) flaw in the Vatican’s official “Click to Pray” application. The vulnerability let anyone query the app’s API with sequential numeric user IDs and retrieve full personal records—including names, emails, birth dates, country of origin and account status—for the roughly 719,000 registered users.

The researcher reported the flaw to the Vatican, but the organization did not respond. The flaw remained live for several months, exposing user data that could be leveraged for targeted phishing attacks impersonating the Vatican. A second issue was later uncovered: the registration endpoint returned the email‑verification hash, allowing account creation without access to the user’s inbox, while confirmation emails failed basic SPF/DKIM/DMARC checks.

The vulnerabilities became public in late July 2026 after a journalist inquiry, prompting the Vatican to finally patch the IDOR flaw and address the registration weakness. The incident highlighted lingering security gaps in the app, which had been launched in 2019 and offered in seven languages across iOS, Android and the web.