CVE-2026-116072

Name of the Vulnerable Software and Affected Versions Infinity for Reddit versions prior to 8.3.5

Description A login cross-site request forgery issue exists in the exported LoginChromeCustomTabActivity redirect handler. The handler uses a hardcoded OAuth state value, which allows an attacker to force a victim to log into an account controlled by the attacker. This is achieved by the attacker authorizing the app's client ID with their own account and delivering an infinity://localhost redirect containing their code and the constant state. Consequently, the victim's activities, including posts, messages, and browsing, occur on the attacker's account.

Recommendations Update Infinity for Reddit to version 8.3.5 or later.