Cross-Site Request Forgery in Infinity for Reddit by Docile Alligator

CVE-2026-116072

What is CVE-2026-116072?

Infinity for Reddit, up to version 8.3.4, has a vulnerability that enables an attacker to exploit login functionality through cross-site request forgery (CSRF). This occurs due to a flaw in the application’s redirect handling, specifically in the LoginChromeCustomTabActivity. By manipulating the OAuth state value, attackers can redirect users to their own accounts without their knowledge. The attacker can obtain an OAuth token for their Reddit account and create a malicious link that, when clicked by a victim, redirects their session to this account, leading to the unauthorized access of posts and private messages.

References