CVE-2026-116072: Infinity for Reddit Login Cross-Site Request Forgery Vulnerability
A login cross-site request forgery (CSRF) vulnerability exists in Infinity for Reddit through version 8.3.4. This vulnerability allows attackers to log victims into an attacker-controlled Reddit account by exploiting a hardcoded OAuth state value in the LoginChromeCustomTabActivity redirect handler. The vulnerability has a CVSS score of 5.4 and is classified as medium severity. Although not actively exploited, it poses a significant risk to users of the Infinity for Reddit app.