Vatican scrambles to stop Pope’s ‘phishing goldmine’ app

In 2019, as Pope Francis launched a digital prayer initiative, he encouraged his followers to join him on a new application called Click To Pray. It was an effort intended to bring spiritual practice into the digital age. But behind the peaceful prayers and app downloads lay a deeply exposed security vulnerability that turned a holy endeavor into a technical nightmare.

What started as a simple prayer tool quickly evolved into a case study on how trust can be exploited. White-hat hacker BobDaHacker uncovered a massive information leak, revealing that the application was rife with security holes that exposed over 700,000 user email addresses.

The vulnerability wasn’t complex; it was fundamentally flawed logic. When users signed up for Click To Pray, the system assigned sequential user IDs—one after another. The flaw emerged when this process lacked basic security checks. A hacker could simply increment an ID number and access anyone else’s profile without any form of authorization or ownership validation.

By manipulating these predictable numbers, BobDaHacker demonstrated that the application allowed unauthorized retrieval of sensitive personal data. This included names, email addresses, country information, dates of birth, and even account deletion status for every user registered on the platform.

The technical oversight was compounded by poor architectural choices. The system also failed to implement rate limiting, meaning a malicious actor could scrape details from every single user in the blink of an eye. Furthermore, security warnings were already present within the app’s communications, with emails sometimes failing domain authentication requirements, suggesting that correspondence from Click To Pray itself looked suspiciously like phishing attempts.

The potential consequences were staggering. Since the application was associated with the Vatican, the exposed data became a significant “phishing goldmine.” Imagine an email appearing to come from the Holy Father, urging urgent attention and featuring a Vatican-style link—the kind of message that would be impossible for many people to ignore. The combination of religious authority and easily accessible personal data created a potent vector for social engineering.

After the information surfaced, there was a period of silence as inquiries were made. It was only when BobDaHacker brought these findings to public attention and journalists investigated the matter that the necessary response finally arrived. Authorization checks were implemented, closing the security loophole and ensuring that users could only access their own data, not the private details of others.

This incident serves as a stark reminder that even the most well-intentioned digital projects require rigorous security. The experience highlights that in the digital world, functionality must always be balanced with ironclad protection, especially when dealing with sensitive information.