Infinity for Reddit EUVD-2026-109386

Exploitation requires the victim to open an attacker-crafted infinity://localhost deep link (a custom-scheme redirect) on a device running Infinity for Reddit version 8.3.4 or earlier, where the exported LoginChromeCustomTabActivity redirect handler validates the OAuth 'state' against a hardcoded constant in APIUtils.java instead of a per-session random value. No attacker authentication against the victim is needed (PR:N), and default configurations are vulnerable, but the attack is limited by the required user interaction (UI:P) - the victim must follow/open the malicious link - and by the need for the vulnerable app to be installed. The impact is also bounded: the victim is logged into the attacker's account rather than the attacker taking over the victim's account.

This is a login/OAuth CSRF (CWE-352) rated CVSS 4.0 5.3 (medium). The vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N shows a network-reachable, low-complexity attack needing no attacker privileges, but it is gated by passive user interaction (UI:P) - the victim must open an attacker-supplied deep link. The confidentiality and integrity impacts are both Low and availability is None, matching a session-fixation-style account swap rather than device or data compromise. On exploitation signals: no CISA KEV listing is present (not actively exploited per that source), no EPSS probability was supplied so widespread-exploitation likelihood cannot be quantified, and no confirmed working exploit code is listed - though VulnCheck published a detailed technical advisory describing the full chain. The vuln.today Decision label is 'this_month', not act_now/emergency, consistent with a real-but-moderate issue: the mechanism is fully disclosed and trivial to reproduce, yet it requires user interaction, targets a niche consumer Android app, and yields only limited impact (victim actions land on the attacker's account rather than the attacker seizing the victim's account). Net: a legitimate, credible flaw worth scheduled remediation, not a drop-everything emergency. Missing data to note explicitly: no EPSS score and no KEV entry were provided, and no fixed version is identified in the available data.

An attacker first authorizes the app's OAuth client ID against their own Reddit account to obtain a valid authorization code, then sends the victim a crafted infinity://localhost redirect containing that code plus the app's hardcoded, constant OAuth state value. When the victim opens the link on a device with Infinity for Reddit (≤8.3.4) installed, the exported LoginChromeCustomTabActivity accepts it because it only checks the hardcoded state, silently logging the victim into the attacker's account so their posts, messages, and browsing occur there. VulnCheck's advisory documents this chain; no confirmed working exploit code is listed in the available data.