CVE-2026-112050 — Gitify before 7.10.0 Login CSRF via Missing OAuth State Validation
Gitify before 7.10.0 contains a login cross-site request forgery vulnerability that allows remote attackers to bind a victim's client to their account because performGitHubWebOA…
Published: 2026-10-18 · CVSS: 2.3 · CVSS 4.0
Gitify before 7.10.0 contains a login cross-site request forgery vulnerability that allows remote attackers to bind a victim's client to their account because performGitHubWebOAuth() omits OAuth state validation. Attackers can get a gitify://oauth?code= link with their own authorization code opened during a victim's pending login, causing Gitify to display attacker-controlled notifications as the victim's own.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7