CVE-2026-112050: Cross-Site Request Forgery (CSRF) in gitify-app gitify

CVE-2026-112050 describes a CSRF vulnerability in Gitify prior to version 7.10.0. The vulnerability arises because the performGitHubWebOAuth() function does not validate the OAuth state parameter, which is intended to prevent CSRF attacks during OAuth login flows. By exploiting this, an attacker can cause a victim's Gitify client to bind to the attacker's GitHub account by triggering the victim to open a specially crafted gitify://oauth?code= link containing the attacker's authorization code. This results in the victim's client displaying notifications controlled by the attacker, effectively impersonating the victim's notification stream.

The vulnerability allows remote attackers to bind a victim's Gitify client to the attacker's GitHub account, leading to the victim seeing attacker-controlled notifications. This could cause confusion or mislead the victim but does not directly lead to privilege escalation or data compromise within Gitify. The CVSS 4.0 score is low (2.3), reflecting limited impact and the requirement for user interaction.

A fix is available in Gitify version 7.10.0 and later, which addresses the OAuth state validation omission. Users should upgrade to version 7.10.0 or newer to remediate this vulnerability. No vendor advisory content is provided, but the version-based fix is indicated by the affectedVersions data.