Login CSRF in Gitify lets attackers bind victims to their account
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Passive
- Attack complexity
- Low
- Attack requirements
- Present
- Impact type
- Tampering
- Confidentiality · integrity · availability
- None · Low · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-352.
Summary
Gitify before 7.10.0 contains a login cross-site request forgery flaw (CWE-352) because performGitHubWebOAuth() omits OAuth state validation. A remote attacker can open a gitify://oauth?code= link carrying the attacker's own authorization code during a victim's pending login, binding the victim's client to the attacker's account. Gitify then displays attacker-controlled notifications as the victim's own, and the attacker needs the victim to take a user action to complete the login.
Written with Claude Haiku 5.5 from the sources below · 2026-10-28
Description from the CNA
Gitify before 7.10.0 contains a login cross-site request forgery vulnerability that allows remote attackers to bind a victim's client to their account because performGitHubWebOAuth() omits OAuth state validation. Attackers can get a gitify://oauth?code= link with their own authorization code opened during a victim's pending login, causing Gitify to display attacker-controlled notifications as the victim's own.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| gitify-app | gitify | before 7.10.0 | 7.10.0 | Patch available | CNA |
- gitify Vendorgitify-app Affected before 7.10.0 Fixed in 7.10.0 Patch available CNA
Remediation
Update gitify to version 7.10.0, which fixes the flaw. The sources list no other fixed version.
Written with Claude Haiku 5.5 from the sources below · 2026-10-28
- Fix · CNA gitify (gitify-app) Fixed in 7.10.0
Timeline
- 2026-10-18 Threatist record created from CVE-2026-112050
- 2026-10-18 Alias added: GHSA-gh5g-g72j-mxwx
- 2026-10-19 CISA SSVC decision points changed
References
Sources
- CVE-2026-112050 · CVE Program
- CVE-2026-112050 · NVD
- FIRST EPSS
- GHSA-gh5g-g72j-mxwx · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences