gitify-app CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

LOW gitify-app CVE published 2026-10-18

CVE-2026-112050

Gitify before 7.10.0 contains a login cross-site request forgery vulnerability. This vulnerability allows remote attackers to bind a victim's client to their account because the performGitHubWebOAuth() function omits OAuth state validation. Attackers can obtain a gitify://oauth?code= link with their own authorization code, which can be opened during a victim's pending login. This causes Gitify to display [truncated]