Technical impact
The Infinity for Reddit application, versions up to 8.3.4, contains a cross‑site request forgery flaw in its OAuth login flow. The redirect handler in LoginChromeCustomTabActivity uses a hardcoded OAuth state value, allowing an attacker to supply a redirect containing an arbitrary valid state string. When the victim accepts the malicious redirect, the app logs the user into the attacker’s Reddit account and all subsequent activity—posts, messages and browsing—occurs under that account. This flaw is a classic state validation weakness (CWE‑352).
Affected Systems
The affected product is Docile‑Alligator’s Infinity for Reddit. All releases up to and including version 8.3.4 are vulnerable because the hardcoded state appears in the code. Users who continue to run any of these releases are susceptible to the described account‑takeover attack.
Risk and Exploitability
The CVSS score of 5.3 indicates moderate risk, but the lack of an EPSS estimate and absence from CISA KEV catalogs suggest that exploitation has not been widely observed yet. Nevertheless, the attack requires the victim to launch the app, click a malicious link or query, and follow the OAuth redirect flow. Attackers must first register the app’s client ID with a Reddit account and then deliver a crafted infinity://localhost redirect that includes the valid but constant state. Because the flaw allows state bypass, the vulnerability can be leveraged without special privileges, making it attractive to attackers who can supply the malicious redirect from a third‑party app or phishing surface.
