Skip to content
Heist/ feed
Back to feed
Medium

Infinity for Reddit through 8.3.4 OAuth Login CSRF via LoginChromeCustomTabActivity

Type: advisorySources: OSV

Infinity for Reddit through 8.3.4 contains a login cross-site request forgery vulnerability that allows attackers to log victims into an attacker-controlled account because the exported LoginChromeCustomTabActivity redirect handler checks a hardcoded OAuth state value. Attackers can authorize the app's client ID with their own Reddit account, then deliver an infinity://localhost redirect containing their code and the constant state, causing the victim's posts, messages, and browsing to occur on the attacker's account.

Products
Not specified
Affected versions
Not specified
Fixed versions
Not specified
CVEs
CVE-2026-116072
Confirmed fixed CVEs
Not specified
Updated in this feed
7 Nov 2026, 04:17 UTC · Revision 1

Source evidence

Infinity for Reddit through 8.3.4 OAuth Login CSRF via LoginChromeCustomTabActivity

core-osv · Original source

Published 25 Oct 2026, 11:50 UTC

Infinity for Reddit through 8.3.4 contains a login cross-site request forgery vulnerability that allows attackers to log victims into an attacker-controlled account because the exported LoginChromeCustomTabActivity redirect handler checks a hardcoded OAuth state value. Attackers can authorize the app's client ID with their own Reddit account, then deliver an infinity://localhost redirect containing their code and the constant state, causing the victim's posts, messages, and browsing to occur on the attacker's account.

osv:CVE-2026-116072
Complete source record
{
  "id": "6208087f6fa4ee15d689b34c7549f9783dc23fbec2d70a75a90d16cd56f31238",
  "url": "https://osv.dev/vulnerability/CVE-2026-116072",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "Infinity for Reddit through 8.3.4 OAuth Login CSRF via LoginChromeCustomTabActivity",
    "summary": "Infinity for Reddit through 8.3.4 contains a login cross-site request forgery vulnerability that allows attackers to log victims into an attacker-controlled account because the exported LoginChromeCustomTabActivity redirect handler checks a hardcoded OAuth state value. Attackers can authorize the app's client ID with their own Reddit account, then deliver an infinity://localhost redirect containing their code and the constant state, causing the victim's posts, messages, and browsing to occur on the attacker's account.",
    "evidence": "osv:CVE-2026-116072",
    "products": [],
    "severity": "medium",
    "structured": {
      "id": "CVE-2026-116072",
      "aliases": [
        "CVE-2026-116072"
      ],
      "metrics": [
        {
          "type": "CVSS_V4",
          "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://github.com/docile-alligator/infinity-for-reddit",
              "type": "GIT",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "last_affected": "3668c0f3d39a20627319a751609b13c203a17d8f"
                }
              ],
              "database_specific": {
                "extracted_events": [
                  {
                    "range": [
                      {
                        "introduced": "0"
                      },
                      {
                        "last_affected": "8.3.4"
                      }
                    ],
                    "source": "AFFECTED_FIELD",
                    "strategy": "StandardRange"
                  },
                  {
                    "range": [
                      {
                        "introduced": "0"
                      },
                      {
                        "last_affected": "8.3.4"
                      }
                    ],
                    "source": "DESCRIPTION"
                  }
                ]
              }
            }
          ],
          "versions": [
            "v8.3.4",
            "v8.3.3",
            "v8.3.2",
            "v8.3.1",
            "v8.3.0",
            "v8.3.0-beta6",
            "v8.3.0-beta5",
            "v8.3.0-beta3",
            "v8.3.0-beta2",
            "v8.2.5",
            "v8.2.4",
            "v8.3.0-beta1",
            "v8.2.1",
            "v8.2.0",
            "v8.2.0-beta1",
            "v8.1.2",
            "v8.1.1",
            "v8.1.0",
            "v8.1.0-beta4",
            "v8.1.0-beta3",
            "v8.1.0-beta2",
            "v8.1.0-beta1",
            "v8.0.8",
            "v8.0.7",
            "v8.0.6",
            "v8.0.5",
            "v8.0.4",
            "v8.0.3",
            "v8.0.2",
            "v8.0.1",
            "v8.0.0",
            "v8.0.0-beta2",
            "v8.0.0-beta1",
            "v7.5.1",
            "v7.5.0",
            "v7.4.4",
            "v7.4.3",
            "v7.4.2",
            "v7.4.1",
            "v7.4.0",
            "v7.4.0-beta3",
            "v7.4.0-beta2",
            "v7.4.0-beta1",
            "v7.3.0",
            "v7.3.0-beta2",
            "v7.3.0-beta1",
            "v7.2.9",
            "v7.2.8",
            "v7.2.7",
            "v7.2.6",
            "v7.2.5",
            "v7.2.4-beta1",
            "v7.2.2-beta1",
            "v7.1.1",
            "v7.2.0-beta1",
            "v7.1.0",
            "v7.1.0-beta1",
            "v7.0.2",
            "v7.0.1",
            "v7.0.0",
            "v7.0.0-beta1",
            "v6.7.3",
            "v6.7.2",
            "v6.7.1",
            "v6.7.0",
            "v6.7.0-beta1",
            "v6.6.0",
            "v6.5.6",
            "v6.5.0-beta1",
            "v6.4.1",
            "v6.4.0",
            "v6.4.0-beta2",
            "v6.4.0-beta1",
            "v6.3.2",
            "v6.3.1",
            "v6.3.0",
            "v6.3.0-beta2",
            "v6.3.0-beta1",
            "v6.2.5",
            "v6.2.3",
            "v6.2.2",
            "v6.2.1",
            "v6.1.1",
            "v6.0.6",
            "v6.0.4",
            "v6.0.2",
            "v6.0.1",
            "v5.4.2",
            "v5.4.2-beta1",
            "v5.4.1",
            "v5.4.0",
            "v5.4.0-beta4",
            "v5.4.0-beta3",
            "v5.3.4",
            "v5.4.0-beta2",
            "v5.4.0-beta1",
            "v5.3.3",
            "v5.3.2",
            "v5.3.1",
            "v5.3.0",
            "v5.3.0-beta1",
            "v5.2.1",
            "v5.2.0",
            "v5.2.0-beta2",
            "v5.2.0-beta1",
            "v5.1.9",
            "v5.1.9-beta2",
            "v5.1.9-beta1",
            "v5.1.8",
            "v5.1.7",
            "v5.1.6",
            "v5.1.6-beta1",
            "v5.1.5",
            "v5.1.4",
            "v5.1.3",
            "v5.1.2",
            "v5.1.1",
            "v5.1.0",
            "v5.1.0-beta3",
            "v5.1.0-beta2",
            "v5.1.0-beta1",
            "v5.0.4",
            "v5.0.3",
            "v5.0.2",
            "v5.0.1",
            "v5.0.0",
            "v5.0.0-beta5",
            "v5.0.0-beta4",
            "v5.0.0-beta3",
            "v5.0.0-beta2",
            "v5.0.0-beta1",
            "v4.3.4",
            "v4.3.3",
            "v4.3.2",
            "v4.3.1",
            "v4.3.0",
            "v4.3.0-beta5",
            "v4.3.0-beta4",
            "v4.3.0-beta3",
            "v4.3.0-beta2",
            "v4.3.0-beta1",
            "v4.2.2",
            "v4.2.1",
            "v4.2.0",
            "v4.2.0-beta2",
            "v4.2.0-beta1",
            "v4.1.0",
            "v4.1.1",
            "v4.1.1-beta1",
            "v4.1.0-beta6",
            "v4.1.0-beta5",
            "v4.1.0-beta4",
            "v4.1.0-beta3",
            "v4.1.0-beta2",
            "v4.1.0-beta1",
            "v4.0.7",
            "v4.0.6",
            "v4.0.5",
            "v4.0.4",
            "v4.0.3",
            "v4.0.2",
            "v4.0.1",
            "v4.0.0",
            "v3.2.0",
            "v3.1.0",
            "v3.0.3",
            "v3.0.2",
            "v3.0.1",
            "v3.0.0",
            "v2.2.3",
            "v2.2.2",
            "v2.2.0",
            "v2.1.0",
            "v2.0.0",
            "v1.6.2",
            "v1.6.1",
            "v1.6.0",
            "v1.5.0",
            "v1.4.1",
            "v1.4.0",
            "v1.3.1",
            "v1.3.0",
            "v1.2.2",
            "v1.2.1",
            "v1.2.0",
            "v1.1.2",
            "v1.1.1",
            "v1.1.0",
            "v1.0.9",
            "v1.0.8",
            "1.0.7",
            "1.0.6",
            "1.0.5",
            "v1.0.4",
            "v1.0.3",
            "v1.0.2",
            "v1.0.1",
            "v1.0"
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-116072.json"
          }
        }
      ],
      "modified": "2026-10-28T02:30:49.514127872Z",
      "provider": "osv",
      "references": [
        "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/116xxx/CVE-2026-116072.json",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-116072",
        "https://www.vulncheck.com/advisories/infinity-for-reddit-through-8.3.4-oauth-login-csrf-via-loginchromecustomtabactivity",
        "https://github.com/Docile-Alligator/Infinity-For-Reddit/issues/1975",
        "https://github.com/Docile-Alligator/Infinity-For-Reddit",
        "https://github.com/Docile-Alligator/Infinity-For-Reddit/blob/v8.3.4/app/src/main/AndroidManifest.xml#L75-L92",
        "https://github.com/Docile-Alligator/Infinity-For-Reddit/blob/v8.3.4/app/src/main/java/ml/docilealligator/infinityforreddit/activities/LoginChromeCustomTabActivity.java#L194-L205",
        "https://github.com/Docile-Alligator/Infinity-For-Reddit/blob/v8.3.4/app/src/main/java/ml/docilealligator/infinityforreddit/utils/APIUtils.java#L43"
      ],
      "provider_metadata": {
        "cwe_ids": [
          "CWE-352"
        ],
        "cna_assigner": "VulnCheck",
        "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/116xxx/CVE-2026-116072.json"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2026-116072",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 518066,
  "published_at": "2026-10-25T11:50:59.942+00:00"
}