Infinity for Reddit versions up to and including 8.3.4 contain a login cross-site request forgery (CSRF) vulnerability. This flaw allows attackers to log victims into attacker-controlled Reddit accounts by exploiting a hardcoded OAuth state value in the LoginChromeCustomTabActivity redirect handler. An attacker can authorize the app with their own Reddit account and then trick victims into using that account, causing their posts, messages, and browsing activity to be performed under the attacker's identity.