Overview
- A security researcher using the name “BobDaHacker” reported a serious flaw to Click to Pray on January 3, 2026, but says the operators did not respond for more than six months.
- The core problem was an unprotected API endpoint that allowed anyone to retrieve user records by supplying a numeric user ID, a type of access-control bug known as an Insecure Direct Object Reference (IDOR).
- Exposed fields included names, email addresses, birthdates, countries and account role/status, and the app also returned email-verification codes in server responses which could let attackers activate or take over accounts.
- The vulnerabilities were reportedly fixed only after Dark Reading published the researcher’s findings in late July 2026, but Click to Pray operators have not publicly acknowledged the incident or told users if data were accessed.
- The leaked information raises a high risk of targeted phishing and account fraud—especially for older or less tech-savvy users—and highlights a breakdown in expected responsible-disclosure and user-notification practices.