Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-112050: Gitify can let attackers hijack a user’s login

CVE-2026-112050 · published today

Summary

Versions of Gitify older than 7.10.0 contain a flaw that lets a remote attacker trick a user into logging in to the attacker’s account during a normal login flow. This could cause the attacker to see notifications and activity that appear to come from the victim. Upgrade Gitify to version 7.10.0 or later to apply the fix.

Original advisory text

Gitify before 7.10.0 Login CSRF via Missing OAuth State Validation

Gitify before 7.10.0 contains a login cross-site request forgery vulnerability that allows remote attackers to bind a victim's client to their account because performGitHubWebOAuth() omits OAuth state validation. Attackers can get a gitify://oauth?code= link with their own authorization code opened during a victim's pending login, causing Gitify to display attacker-controlled notifications as the victim's own.

References

https://github.com/gitify-app/gitify/blob/v7.9.0/src/renderer/utils/forges/githu... Third Party Advisory
https://github.com/gitify-app/gitify/commit/10235b243e167a7c76eafd6a3d0ebc8c575e... Patch
https://github.com/gitify-app/gitify/issues/3425 Third Party Advisory
https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/112xxx/CVE-2026-1120... Vendor Advisory
https://github.com/gitify-app/gitify Product
https://github.com/gitify-app/gitify/releases/tag/v7.10.0 Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-112050 Vendor Advisory
https://www.vulncheck.com/advisories/gitify-before-7.10.0-login-csrf-via-missing... Vendor Advisory

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit (estimated)
Gives an attacker partial control (estimated)

Severity

7.8 High

Type

CWE-352Cross-Site Request Forgery (CSRF)

Timeline

Published18 Oct 2026

Updated19 Oct 2026

First seen18 Oct 2026

Sources

CVE-2026-112050 · NVD

CVE-2026-112050 · OSV

Track software like this

Free during beta