Live › vulnerability › CVE-2026-116072
Go to dashboardInfinity for Reddit, an Android client, accepts a login redirect that checks a hardcoded OAuth state value, so an attacker can craft a link that logs the victim into the attacker's Reddit account. The victim's posts, messages and browsing then happen on the attacker's account.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-25 12:40 UTC. All times on this page are UTC.
Users of the Infinity for Reddit Android app at version or earlier who sign in to Reddit through the app. People who do not use this app, or who run a newer build, are not described as affected. The sources do not say whether other Reddit clients share the flaw.
8.3.4No product ranges from the sources yet.
8.3.4.8.3.4; the sources do not name the fixed version.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Infinity for Reddit through 8.3.4 contains a login cross-site request forgery vulnerability that allows attackers to log victims into an attacker-controlled account because the exported LoginChromeCustomTabActivity redirect handler checks a hardcoded OAuth state value. Attackers can authorize the app's client ID with their own Reddit account, then deliver an infinity://localhost redirect containing their code and the constant state, causing the victim's posts, messages, and browsing to occur on the attacker's account.
This page as .md · .json · in your agent: get_signal("CVE-2026-116072")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.