CVE-2026-112050 Details
Description
Gitify before 7.10.0 contains a login cross-site request forgery vulnerability that allows remote attackers to bind a victim's client to their account because performGitHubWebOAuth() omits OAuth state validation. Attackers can get a gitify://oauth?code= link with their own authorization code opened during a victim's pending login, causing Gitify to display attacker-controlled notifications as the victim's own.
A cross-site request forgery (CSRF) vulnerability has been identified in Gitify versions prior to 7.10.0. This vulnerability allows remote attackers to bind a victim's client to their own GitHub account by exploiting the missing OAuth state validation in the login process. Attackers can intercept an authorization code intended for the victim and use it to authenticate as the victim, potentially leading to unauthorized access to attacker-controlled notifications within the Gitify application.
Users can update to Gitify version 7.10.0 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 18, 2026CISA-ADP
Assessed Oct 19, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/gitify-app/gitify/blob/v7.9.0/src/renderer/utils/forges/github/flows.ts#L35-L76 | [email protected] | Source CodeVendor |
| https://github.com/gitify-app/gitify/commit/10235b243e167a7c76eafd6a3d0ebc8c575eebc7 | [email protected] | Source CodeVendor |
| https://github.com/gitify-app/gitify/issues/3425 | [email protected] | ExploitIssue TrackingTechnical AnalysisVendor |
| https://github.com/gitify-app/gitify/releases/tag/v7.10.0 | [email protected] | Release NotesVendor |
| https://www.vulncheck.com/advisories/gitify-before-7.10.0-login-csrf-via-missing-oauth-state-validation | [email protected] | AdvisoryRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-352 | Cross-Site Request Forgery (CSRF) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Gitify | >= 0, < 7.10.0 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 19, 2026 | CVE Modified | CISA-ADP |
| Oct 18, 2026 | New CVE Received | [email protected] |