{"id":"CVE-2026-112050","kind":"vulnerability","aliases":["CVE-2026-112050"],"related":[],"title":"Gitify: missing OAuth state check lets attackers bind victim's GitHub login","description":"Gitify before 7.10.0 contains a login cross-site request forgery vulnerability that allows remote attackers to bind a victim's client to their account because performGitHubWebOAuth() omits OAuth state validation. Attackers can get a gitify://oauth?code= link with their own authorization code opened during a victim's pending login, causing Gitify to display attacker-controlled notifications as the victim's own.","summary":"Gitify, a desktop GitHub notifications client, skips OAuth state validation during login, so a crafted gitify:// link can swap in the attacker's authorization code. The victim's Gitify then shows the attacker's GitHub notifications as their own.","severity":"low","cvss":3.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["desktop","github","gitify","oauth","package"],"not_affected_if":["default-config"],"how_to_check":"- Check the installed Gitify version in the app's About dialog or package metadata; versions below `7.10.0` are affected.\n- unknown","fix":"- Upgrade Gitify to `7.10.0` or later.\n- Sign out and sign back in after upgrading if the client was logged in during a pending login window.","status":"open","published_at":"2026-10-18T13:16:37+00:00","first_seen_at":"2026-10-23T21:57:15+00:00","triaged_at":"2026-10-25T04:47:48+00:00","updated_at":"2026-10-25T04:47:48+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T04:47:48Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Gitify to `7.10.0` or later.\n- Sign out and sign back in after upgrading if the client was logged in during a pending login window.","reach":"internet","title":"Gitify: missing OAuth state check lets attackers bind victim's GitHub login","impact":"low","summary":"Gitify, a desktop GitHub notifications client, skips OAuth state validation during login, so a crafted gitify:// link can swap in the attacker's authorization code. The victim's Gitify then shows the attacker's GitHub notifications as their own.","category":"package","nicknames":[],"who_cares":["gitify","desktop","github","oauth"],"confidence":0.7,"needs_auth":"no","worst_case":"Victim's client shows attacker-controlled GitHub notifications as their own","analyst_note":"","how_to_check":"- Check the installed Gitify version in the app's About dialog or package metadata; versions below `7.10.0` are affected.\n- unknown","needs_analyst":false,"not_affected_if":["default-config"],"who_is_affected":"Anyone running the Gitify desktop client before 7.10.0 who starts a GitHub login. Exposure needs a victim to open an attacker-supplied gitify:// link while their login is pending. Users on 7.10.0 or later, or who are not logging in, are not affected.","user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"low"},"cost_usd":0.000582,"input_tokens":3352,"output_tokens":494,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-112050':15A,18A '-2026':14A,17A '7.10.0':61C 'account':83C 'allow':72C 'attack':7A,44B,55B,74C,90C,114C 'attacker-control':113C 'author':46B,100C 'bind':8A,76C 'caus':109C 'check':5A 'client':29B,80C 'code':47B,95C,101C 'contain':62C 'control':115C 'craft':38B 'cross':66C 'cross-sit':65C 'cve':13A,16A 'desktop':19B,26B 'display':112C 'forgeri':69C 'get':92C 'github':11A,20B,27B,57B 'gitifi':1A,21B,24B,51B,59C,110C 'let':6A 'link':39B,96C 'login':12A,35B,64C,108C 'miss':2A 'notif':28B,58B,116C 'oauth':3A,22B,31B,87C,94C 'omit':86C 'open':102C 'packag':23B 'pend':107C 'performgithubweboauth':85C 'remot':73C 'request':68C 'show':53B 'site':67C 'skip':30B 'state':4A,32B,88C 'swap':41B 'valid':33B,89C 'victim':9A,49B,78C,105C,119C 'vulner':70C","nicknames":[],"mitigations":[],"who_affected":"Anyone running the Gitify desktop client before 7.10.0 who starts a GitHub login. Exposure needs a victim to open an attacker-supplied gitify:// link while their login is pending. Users on 7.10.0 or later, or who are not logging in, are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T13:16:37+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112050","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112050","severity":null,"published_at":"2026-10-18T13:16:37+00:00","modified_at":"2026-10-19T21:14:14+00:00","first_seen_at":"2026-10-23T21:57:15+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}