Cross-Site Request Forgery in Gitify Affects User Authentication

CVE-2026-112050

What is CVE-2026-112050?

Gitify versions prior to 7.10.0 are vulnerable to a cross-site request forgery (CSRF) attack due to a lack of proper OAuth state validation in the performGitHubWebOAuth() function. This vulnerability allows attackers to create a malicious link that, when activated by a victim, can bind the victim's client to the attacker's account, enabling the attacker to send notifications under the guise of the victim's account. Users are encouraged to update to version 7.10.0 or higher to mitigate this risk.

References