CVE-2026-116072
Received Received - Intake

Cross-Site Request Forgery in Infinity for Reddit

Publication date: 2026-10-25

Last updated on: 2026-10-25

Assigner: VulnCheck

Description
Infinity for Reddit through 8.3.4 contains a login cross-site request forgery vulnerability that allows attackers to log victims into an attacker-controlled account because the exported LoginChromeCustomTabActivity redirect handler checks a hardcoded OAuth state value. Attackers can authorize the app's client ID with their own Reddit account, then deliver an infinity://localhost redirect containing their code and the constant state, causing the victim's posts, messages, and browsing to occur on the attacker's account.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-25
Last Modified
2026-10-25
Generated
2026-10-25
AI Q&A
2026-10-25
EPSS Evaluated
N/A
NVD
CVE-2026-116072
EUVD
EUVD-2026-109386

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Docile-Alligator Infinity for Reddit 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-352 The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-116072 is a Cross-Site Request Forgery (CSRF) vulnerability in the Infinity for Reddit Android app through version 8.3.4. The app's LoginChromeCustomTabActivity uses a hardcoded OAuth state value instead of generating a unique one per session. This allows attackers to craft malicious links that log victims into the attacker's Reddit account without their knowledge. When a victim clicks the link, their Reddit activity (posts, messages, browsing) occurs under the attacker's account.

Detection Guidance

Check if the Infinity for Reddit app is installed on your Android device. Inspect the app's exported activities, particularly LoginChromeCustomTabActivity, by examining the AndroidManifest.xml file. Look for the custom URI scheme 'infinity://localhost' and verify if the OAuth state parameter is hardcoded. Use tools like APKTool to decompile the APK and review the source code for the hardcoded state value '23ro8xlxvzp4asqd'.

Commands to check: adb shell pm list packages | grep infinity; adb shell dumpsys package ml.docilealligator.infinityforreddit | grep -E 'activities|exported'; apktool d app.apk to decompile and inspect the manifest and source files.

Impact Analysis

If you use the vulnerable Infinity for Reddit app, an attacker could trick you into clicking a malicious link. This would log you into their Reddit account, allowing them to perform actions like posting, messaging, or browsing as you. Your Reddit activity would appear under their account, potentially exposing your data or reputation. The attack requires minimal interaction, just clicking a link.

Mitigation Strategies

Uninstall the Infinity for Reddit app immediately. Avoid clicking any links with the 'infinity://localhost' URI scheme. Update to the latest patched version if available. Consider switching to alternative Reddit clients until a fix is implemented. Monitor your Reddit account for unauthorized activity.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-116072. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart