CVE-2026-112050 gitify-app CVE debrief

Who should care

Defenders responsible for Gitify installations should assess exposure and prioritize verification of OAuth state validation and upgrading to version 7.10.0 or later. This includes reviewing configurations, monitoring for suspicious activity, and ensuring that compensating controls are in place for exposed systems.

Why it matters

CVE-2026-112050 is a login cross-site request forgery vulnerability in Gitify before 7.10.0. Defenders should prioritize verifying OAuth state validation and upgrading to version 7.10.0 or later to prevent account binding and display of attacker-controlled notifications.

• Defenders must verify OAuth state validation in Gitify configurations to prevent account binding.
• Upgrading to Gitify version 7.10.0 or later is necessary to fix the vulnerability.
• Defenders should monitor Gitify installations for suspicious activity related to this vulnerability.

Technical summary

The performGitHubWebOAuth() function in Gitify before 7.10.0 omits OAuth state validation, allowing remote attackers to bind a victim's client to their account. Attackers can obtain a gitify://oauth?code= link with their own authorization code, which can be opened during a victim's pending login, causing Gitify to display attacker-controlled notifications as the victim's own. This vulnerability allows remote attackers to bind a victim's client to their account because the performGitHubWebOAuth() function omits OAuth state validation. Defenders should prioritize verifying OAuth state validation and upgrading to version 7.10.0 or later to prevent account binding and display of attacker-controlled notifications.

Defensive priority

Defenders should prioritize verifying OAuth state validation in Gitify configurations and upgrading to version 7.10.0 or later.

Recommended defensive actions

• Verify OAuth state validation in Gitify configurations
• Upgrade to Gitify version 7.10.0 or later
• Monitor Gitify installations for suspicious activity
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details about the vulnerability. However, the corpus does not establish versions, exploitation, impact, or remediation beyond upgrading to version 7.10.0 or later.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.