Infinity For Reddit
Monthly
Login CSRF in Infinity for Reddit through version 8.3.4 lets an attacker silently log a victim into the attacker's own Reddit account. The exported LoginChromeCustomTabActivity validates the OAuth 'state' parameter against a hardcoded constant in APIUtils.java rather than a per-session random value, so an attacker can authorize the app's client ID on their own Reddit account and deliver an infinity://localhost redirect containing the attacker's authorization code plus the constant state value. A victim who opens that crafted deep link then browses, posts, and reads messages under the attacker's account, which can expose content the victim subsequently submits or manipulate their view of the service. No public exploit code or active exploitation is confirmed in the supplied data; severity is medium (CVSS 4.0 5.3) and exploitation requires the victim to open the crafted link on a device with the vulnerable app installed.
Login CSRF in Infinity for Reddit through version 8.3.4 lets an attacker silently log a victim into the attacker's own Reddit account. The exported LoginChromeCustomTabActivity validates the OAuth 'state' parameter against a hardcoded constant in APIUtils.java rather than a per-session random value, so an attacker can authorize the app's client ID on their own Reddit account and deliver an infinity://localhost redirect containing the attacker's authorization code plus the constant state value. A victim who opens that crafted deep link then browses, posts, and reads messages under the attacker's account, which can expose content the victim subsequently submits or manipulate their view of the service. No public exploit code or active exploitation is confirmed in the supplied data; severity is medium (CVSS 4.0 5.3) and exploitation requires the victim to open the crafted link on a device with the vulnerable app installed.