{"id":"CVE-2026-116072","title":"Infinity for Reddit through 8.3.4 OAuth Login CSRF via LoginChromeCustomTabActivity","summary":"Infinity for Reddit through 8.3.4 contains a login cross-site request forgery vulnerability that allows attackers to log victims into an attacker-controlled account because the exported LoginChromeCustomTabActivity redirect handler check…","severity":"medium","cvss":5.4,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","cvssSource":"cna","cwe":["CWE-352"],"vendor":"Docile-Alligator","product":"Infinity for Reddit","affected":["infinity_for_reddit <= 8.3.4"],"published":"2026-10-25","updated":"2026-10-25","sourceUpdated":"2026-10-25T11:50:59.942Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-116072","references":[{"url":"https://github.com/Docile-Alligator/Infinity-For-Reddit/issues/1975","label":"GitHub Issue #1975"},{"url":"https://github.com/Docile-Alligator/Infinity-For-Reddit"},{"url":"https://github.com/Docile-Alligator/Infinity-For-Reddit/blob/v8.3.4/app/src/main/java/ml/docilealligator/infinityforreddit/activities/LoginChromeCustomTabActivity.java#L194-L205"},{"url":"https://github.com/Docile-Alligator/Infinity-For-Reddit/blob/v8.3.4/app/src/main/java/ml/docilealligator/infinityforreddit/utils/APIUtils.java#L43"},{"url":"https://github.com/Docile-Alligator/Infinity-For-Reddit/blob/v8.3.4/app/src/main/AndroidManifest.xml#L75-L92"},{"url":"https://www.vulncheck.com/advisories/infinity-for-reddit-through-8.3.4-oauth-login-csrf-via-loginchromecustomtabactivity","label":"VulnCheck Advisory: Infinity for Reddit through 8.3.4 OAuth Login CSRF via LoginChromeCustomTabActivity"}],"tags":["cve.org"],"ingestedAt":"2026-10-25T22:08:29.958Z","slug":"CVE-2026-116072","body":"## Overview\n\nInfinity for Reddit through 8.3.4 contains a login cross-site request forgery vulnerability that allows attackers to log victims into an attacker-controlled account because the exported LoginChromeCustomTabActivity redirect handler checks a hardcoded OAuth state value. Attackers can authorize the app's client ID with their own Reddit account, then deliver an infinity://localhost redirect containing their code and the constant state, causing the victim's posts, messages, and browsing to occur on the attacker's account.\n\n## Affected\n\n- `infinity_for_reddit <= 8.3.4`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":30,"depthScoreParts":{"impact":29.7,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}