CVE-2026-116072 Infinity for Reddit through 8.3.4 OAuth Login CSRF via LoginChromeCustomTabActivity

Infinity for Reddit through 8.3.4 contains a login cross-site request forgery vulnerability that allows attackers to log victims into an attacker-controlled account because the exported LoginChromeCustomTabActivity redirect handler checks a hardcoded OAuth state value. Attackers can authorize the...

CVE-2026-116072

The Infinity for Reddit application (through version 8.3.4 ) is vulnerable to a login cross-site request forgery (CSRF) vulnerability within the LoginChromeCustomTabActivity redirect handler. The root cause is the handler's use of a hardcoded OAuth state value . An attacker can authorize the app'...

CVE-2026-34460: Authentication Bypass by Assumed-Immutable Data

NamelessMC is website software for Minecraft servers. In versions 2.2.4 and prior, the OAuth callback handling does not validate the state parameter server-side before exchanging the authorization code. This allows an attacker to capture a valid OAuth callback URL for their own account and cause ...