x
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Passive
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Tampering
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- No fix listed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-352.
Summary
Infinity for Reddit through 8.3.4 by Docile-Alligator contains a login cross-site request forgery flaw (CWE-352) in the exported LoginChromeCustomTabActivity redirect handler, which checks a hardcoded OAuth state value. A remote attacker can make a victim's app log into an attacker-controlled Reddit account, so the victim's posts, messages and browsing occur on that account, but the victim must open a crafted redirect.
Written with Claude Haiku 5.5 from the sources below · 2026-10-28
Description from the CNA
Infinity for Reddit through 8.3.4 contains a login cross-site request forgery vulnerability that allows attackers to log victims into an attacker-controlled account because the exported LoginChromeCustomTabActivity redirect handler checks a hardcoded OAuth state value. Attackers can authorize the app's client ID with their own Reddit account, then deliver an infinity://localhost redirect containing their code and the constant state, causing the victim's posts, messages, and browsing to occur on the attacker's account.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Docile-Alligator | Infinity for Reddit | up to 8.3.4 | — | No fix listed | CNA |
- Infinity for Reddit VendorDocile-Alligator Affected up to 8.3.4 Fixed in — No fix listed CNA
Remediation
The sources list no fixed version for Infinity for Reddit.
Written with Claude Haiku 5.5 from the sources below · 2026-10-28
Timeline
- 2026-10-25 Threatist record created from CVE-2026-116072
- 2026-10-26 CISA SSVC decision points changed
- 2026-10-27 Alias added: GHSA-cm7p-vqx2-9527
References
Other 5
- GitHub Issue #1975
- https://github.com/Docile-Alligator/Infinity-For-Reddit
- https://github.com/Docile-Alligator/Infinity-For-Reddit/blob/v8.3.4/app/src/main/java/ml/docilealligator/infinityforreddit/activities/LoginChromeCustomTabActivity.java#L194-L205
- https://github.com/Docile-Alligator/Infinity-For-Reddit/blob/v8.3.4/app/src/main/java/ml/docilealligator/infinityforreddit/utils/APIUtils.java#L43
- https://github.com/Docile-Alligator/Infinity-For-Reddit/blob/v8.3.4/app/src/main/AndroidManifest.xml#L75-L92
Sources
- CVE-2026-116072 · CVE Program
- CVE-2026-116072 · NVD
- FIRST EPSS
- GHSA-cm7p-vqx2-9527 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences