CVE-2026-112050: Gitify before 7.10.0 Login CSRF via Missing OAuth State Validation
Gitify before 7.10.0 contains a login cross-site request forgery vulnerability that allows remote attackers to bind a victim's client to their account because performGitHubWebOAuth() omits OAuth state validation. Attackers can get a gitify://oauth?code= link with their own authorization code opened during a victim's pending login, causing Gitify to display attacker-controlled notifications as the victim's own.
Affected Software
Event History
Frequently Asked Questions
What conditions are required for exploitation?
The victim must have a Gitify login in progress and open an attacker-supplied gitify://oauth?code= link containing an authorization code obtained for the attacker’s account. The attack does not require prior privileges, but it requires user interaction.
What is the practical impact if exploitation succeeds?
Gitify can become bound to the attacker’s account, so the victim may see notifications controlled by that account as though they were their own. The provided severity vector indicates integrity impact only, with no stated confidentiality or availability impact.
Which versions should be remediated?
Gitify versions before 7.10.0 are affected. Upgrade to version 7.10.0 or later, which is identified by the provided release reference.