Live › vulnerability › CVE-2026-112050
Go to dashboardGitify, a desktop GitHub notifications client, skips OAuth state validation during login, so a crafted gitify:// link can swap in the attacker's authorization code. The victim's Gitify then shows the attacker's GitHub notifications as their own.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Anyone running the Gitify desktop client before 7.10.0 who starts a GitHub login. Exposure needs a victim to open an attacker-supplied gitify:// link while their login is pending. Users on 7.10.0 or later, or who are not logging in, are not affected.
No product ranges from the sources yet.
7.10.0 are affected.7.10.0 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Gitify before 7.10.0 contains a login cross-site request forgery vulnerability that allows remote attackers to bind a victim's client to their account because performGitHubWebOAuth() omits OAuth state validation. Attackers can get a gitify://oauth?code= link with their own authorization code opened during a victim's pending login, causing Gitify to display attacker-controlled notifications as the victim's own.
This page as .md · .json · in your agent: get_signal("CVE-2026-112050")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.