The Pope's Official Prayer App Sends Your Prayers to the Almighty—And Your Data to Hackers
A security flaw in the Pope's official prayer app and online prayer platform, Click to Pray, has exposed personal data from over 719,000 accounts. Users' full names, birthdates, and more have leaked through an insecure API endpoint in a data disaster that's remained open for months after its discovery.
The flaw stems from a broken access control channel, also known as an IDOR issue, Tom's Hardware reports. Put simply, the app provides account data to anyone who enters a user ID into the API endpoint, even if that account doesn't belong to them.
BobDaHacker, the white-hat hacker and security enthusiast who located the vulnerability, says they reached out to nine different people in an attempt at responsible disclosure. That was back in January, and the vulnerability still has not been addressed, they say.
The exposed data includes names, birthdates, email addresses, countries of origin and residence, and in some...
Copyright of this story solely belongs to extremetech.com. To see the full text click HERE
