Pope's official prayer app leaks data of 700K+ users
Security flaw left vulnerable for months, exposing sensitive information.
1Major security flaw in Pope-endorsed app
The Click To Pray app, endorsed by the Pope, failed to protect the personal data of over 700,000 users. Names, emails, and birthdates were exposed. Ethical hacker BobDaHacker reported the issue in January, but it remains unresolved, leaving user data at risk.
2How the IDOR vulnerability works
The app's API had an Insecure Direct Object Reference (IDOR) flaw, allowing anyone to access user data by simply entering an ID number. With no authorization checks, a simple loop could scrape all user data. The lack of basic security measures poses a significant threat.
3Who is affected?
Many users are elderly and less tech-savvy, making them prime targets for phishing. Their trust in Vatican-related platforms increases their vulnerability. Attackers could easily exploit the leaked data to craft convincing scams, putting users at serious risk.
4A phishing goldmine
The leaked email addresses are a treasure trove for attackers. Fake emails with subject lines like 'Urgent message from the Pope' could easily trick users. Ironically, the app's real verification emails already look suspicious, making it harder to distinguish legitimate messages.
5Faulty verification system
The app's sign-up process returns the verification link's UUID directly in the response, allowing attackers to register with any email and verify it instantly. Additionally, the real verification emails fail domain authentication, further eroding trust in the platform's security.
6What this negligence reveals
This incident highlights how even religious institutions can neglect digital security. Protecting user data should be a top priority, yet such oversights create massive risks. The app's continued silence on the issue only deepens concerns about accountability and user safety.