CVE-2026-116072
Gravedad CVSS v4.0:
MEDIA
Tipo:
CWE-352
Falsificación de petición en sitios cruzados (Cross-Site Request Forgery)
Fecha de publicación:
25/10/2026
Última modificación:
25/10/2026
Descripción
*** Pendiente de traducción *** Infinity for Reddit through 8.3.4 contains a login cross-site request forgery vulnerability that allows attackers to log victims into an attacker-controlled account because the exported LoginChromeCustomTabActivity redirect handler checks a hardcoded OAuth state value. Attackers can authorize the app's client ID with their own Reddit account, then deliver an infinity://localhost redirect containing their code and the constant state, causing the victim's posts, messages, and browsing to occur on the attacker's account.
Impacto
Puntuación base 4.0
5.30
Gravedad 4.0
MEDIA
Puntuación base 3.x
5.40
Gravedad 3.x
MEDIA
Referencias a soluciones, herramientas e información
- https://github.com/Docile-Alligator/Infinity-For-Reddit
- https://github.com/Docile-Alligator/Infinity-For-Reddit/blob/v8.3.4/app/src/main/AndroidManifest.xml#L75-L92
- https://github.com/Docile-Alligator/Infinity-For-Reddit/blob/v8.3.4/app/src/main/java/ml/docilealligator/infinityforreddit/activities/LoginChromeCustomTabActivity.java#L194-L205
- https://github.com/Docile-Alligator/Infinity-For-Reddit/blob/v8.3.4/app/src/main/java/ml/docilealligator/infinityforreddit/utils/APIUtils.java#L43
- https://github.com/Docile-Alligator/Infinity-For-Reddit/issues/1975
- https://www.vulncheck.com/advisories/infinity-for-reddit-through-8.3.4-oauth-login-csrf-via-loginchromecustomtabactivity