Executive Intelligence Brief

A login cross-site request forgery (CSRF) vulnerability exists in Infinity for Reddit through version 8.3.4. This vulnerability allows attackers to log victims into an attacker-controlled Reddit account by exploiting a hardcoded OAuth state value in the LoginChromeCustomTabActivity redirect handler. The vulnerability has a CVSS score of 5.4 and is classified as medium severity. Although not actively exploited, it poses a significant risk to users of the Infinity for Reddit app. Immediate patching or mitigation is recommended.

Threat Overview

The Infinity for Reddit app, a popular client for accessing Reddit on Android devices, is affected by a login CSRF vulnerability. This type of vulnerability occurs when an attacker can trick a user into performing unintended actions on a web application that the user is authenticated to. In this case, the vulnerability is caused by the app's use of a hardcoded OAuth state value in the LoginChromeCustomTabActivity redirect handler. This allows an attacker to authorize the app's client ID with their own Reddit account and then deliver a malicious redirect containing their code and the constant state, causing the victim's posts, messages, and browsing to occur on the attacker's account.

Technical Deep Dive

Vulnerability Classification

The vulnerability is classified as CWE-352, Cross-Site Request Forgery (CSRF). This type of vulnerability occurs when an attacker can trick a user into performing unintended actions on a web application that the user is authenticated to.

Root Cause Analysis

The root cause of the vulnerability is the use of a hardcoded OAuth state value in the LoginChromeCustomTabActivity redirect handler. This allows an attacker to predict and exploit the state value, enabling them to log victims into an attacker-controlled account.

Attack Vector & Chain

The attack vector is network-based (AV:N), and the attack complexity is low (AC:L). The vulnerability requires no privileges (PR:N) but does require user interaction (UI:R). The scope of the vulnerability is unchanged (S:U), and the impact is low for confidentiality (C:L) and integrity (I:L), with no impact on availability (A:N).

Exploitation Scenario Walkthrough

Scenario: Logging into an Attacker-Controlled Account via CSRF

1. Reconnaissance: An attacker discovers that the Infinity for Reddit app through version 8.3.4 is vulnerable to a login CSRF vulnerability.

2. Weaponization: The attacker prepares a malicious redirect URL containing their code and the constant OAuth state value.

3. Delivery & Exploitation: The attacker delivers the malicious redirect URL to the victim, who clicks on it, causing the victim's browser to send a request to the Infinity for Reddit app with the attacker's code and state value.

4. Post-Exploitation: The attacker gains control of the victim's account, allowing them to perform actions as the victim, such as posting, messaging, and browsing.

5. Impact Realization: The attacker can now access the victim's account and perform actions on their behalf, potentially leading to reputational damage, data exposure, or further exploitation.

Exploitation in the Wild

The vulnerability is not actively exploited at this time. However, given its medium severity and the potential for significant impact, it is essential to patch or mitigate the vulnerability as soon as possible.

Impact Analysis

Direct Impact

The direct impact of the vulnerability is a loss of confidentiality (C:L) and integrity (I:L), with no impact on availability (A:N). An attacker can log victims into an attacker-controlled account, potentially leading to reputational damage, data exposure, or further exploitation.

Downstream & Cascading Effects

The downstream and cascading effects of the vulnerability could include reputational damage to the Infinity for Reddit app and its users, potential data exposure or loss, and further exploitation of the victim's account.

Affected Products & Versions

The Infinity for Reddit app through version 8.3.4 is affected. Users should upgrade to a patched version as soon as possible.

Detection & Threat Hunting

Indicators of Compromise

No specific indicators of compromise (IoCs) are provided, but monitoring for unusual account activity or login attempts from unknown locations may indicate exploitation.

Detection Rules & Signatures

Conceptual SIEM/EDR detection logic could include monitoring for:

  • Unusual login attempts from unknown locations
  • Multiple failed login attempts from a single IP address
  • Login attempts with suspicious or unknown user agents

Threat Hunting Queries

Threat hunting queries could include searching for:

  • Login attempts from unknown or suspicious IP addresses
  • Unusual user agent strings or device information
  • Multiple login attempts from a single device or IP address

Remediation & Hardening

Immediate Actions (0-24 hours)

Users should immediately update the Infinity for Reddit app to a patched version (if available) or apply a temporary workaround, such as disabling the login feature or using a different Reddit client.

Short-Term Hardening (1-7 days)

In addition to patching, users should:

  • Monitor their account activity closely for suspicious behavior
  • Enable two-factor authentication (2FA) on their Reddit account
  • Use a web application firewall (WAF) or other security controls to detect and prevent CSRF attacks

Strategic Recommendations

Long-term recommendations include:

  • Regularly updating and patching the Infinity for Reddit app
  • Implementing additional security controls, such as 2FA and WAFs
  • Conducting regular security audits and penetration testing to identify and address potential vulnerabilities

Analyst Assessment

The vulnerability has a medium severity and is not actively exploited at this time. However, given its potential impact and the ease of exploitation, it is essential to patch or mitigate the vulnerability as soon as possible. The risk of inaction is significant, and organizations should prioritize patching and implementing additional security controls.

Sources

  • National Vulnerability Database (NVD) - CVE-2026-116072