CVE-2026-116072 in Infinity for Reddit
Summary
by MITRE • 10/25/2026
Infinity for Reddit through 8.3.4 contains a login cross-site request forgery vulnerability that allows attackers to log victims into an attacker-controlled account because the exported LoginChromeCustomTabActivity redirect handler checks a hardcoded OAuth state value. Attackers can authorize the app's client ID with their own Reddit account, then deliver an infinity://localhost redirect containing their code and the constant state, causing the victim's posts, messages, and browsing to occur on the attacker's account.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/25/2026
The vulnerability identified in Infinity for Reddit versions up through 8.3.4 represents a critical authentication bypass mechanism rooted in improper validation of OAuth flow parameters during the login process. This flaw specifically affects the LoginChromeCustomTabActivity component, which serves as the redirect handler when users authenticate via an external browser using Chrome Custom Tabs. The core technical deficiency lies in the application's failure to dynamically validate the state parameter returned by the authorization server against a session-specific value generated at the start of the login request. Instead, the application relies on a hardcoded OAuth state constant for verification purposes. This architectural decision fundamentally breaks the security guarantee provided by the OpenID Connect and OAuth 2.0 standards, which mandate that the state parameter be unique per authentication request to prevent cross-site request forgery attacks.
From an operational perspective, this flaw allows attackers to execute a sophisticated account takeover scenario without requiring any prior access to the victim's credentials or device. By exploiting the predictable nature of the hardcoded state value, an attacker can first register their own malicious application with Reddit as an OAuth client and obtain a valid client ID. The attacker then constructs a deceptive link containing an infinity://localhost redirect URI that includes both the authorization code issued by Reddit for the attacker's account and the static, expected state value. When a victim clicks this link or is tricked into opening it within the Infinity app, the application processes the response as if it were part of its own legitimate login flow. Because the hardcoded state matches what the server expects, the application accepts the authorization code associated with the attacker's account and completes the authentication process for that specific user session.
The impact of this vulnerability is severe, resulting in a complete compromise of the victim's privacy and data integrity within the Reddit ecosystem. Once authenticated as the attacker-controlled account, all subsequent actions performed by the Infinity app on behalf of the victim are attributed to the attacker. This includes viewing private messages, reading browsing history, accessing saved posts, and potentially posting content under the victim's identity if further permissions were granted or implied. The attack effectively hijacks the user session, allowing the adversary to impersonate the legitimate user across all features that rely on this authentication mechanism. This constitutes a significant breach of confidentiality and integrity for both the individual user and any entities interacting with them through their account.
This vulnerability aligns closely with CWE-352, which describes Cross-Site Request Forgery (CSRF), specifically in the context where the application fails to verify that an incoming request originated from its own trusted source or session state. Furthermore, it maps to MITRE ATT&CK technique T1078, Valid Accounts, as the attacker leverages valid credentials by tricking the system into authenticating a different user's token under their control. The exploitation also reflects CWE-345, Insufficient Verification of Data Authenticity, due to the reliance on static values rather than dynamic session tracking for critical security decisions.
Mitigation strategies must prioritize the immediate implementation of secure OAuth state management practices. Developers should ensure that every authentication request generates a unique, cryptographically random state value stored securely in the application's local session storage or encrypted shared preferences. Upon receiving the redirect response from the identity provider, the application must strictly compare this returned state against the one generated for that specific login attempt before proceeding with token exchange. Additionally, implementing strict validation of redirect URIs to ensure they match only pre-registered and expected endpoints is essential. For users currently affected by this vulnerability in Infinity versions up through 8.3.4, it is imperative to update to a patched version where the state parameter handling has been corrected. Until an official patch is available or if updating is not immediately possible, users should exercise extreme caution when interacting with deep links from untrusted sources and consider using alternative clients that adhere strictly to OAuth security standards until the issue is resolved by the vendor.