CVE-2026-112050— Gitify before 7.10.0 Login CSRF via Missing OAuth State Validation
Quick assessment
Affected
gitify-app gitify
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 7.10.0 版本之前的 Gitify 存在登录跨站请求伪造（CSRF）漏洞。由于 函数未对 OAuth 状态（state）进行验证，远程攻击者可将受害者的客户端绑定到攻击者自己的账户。攻击者能够诱使受害者在登录挂起期间打开包含其自身授权代码的 链接，导致 Gitify 将攻击者控制的通知以受害者身份显示。
Possible ATT&CK Techniques 1 AI
T1190.002
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-112050
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Gitify before 7.10.0 Login CSRF via Missing OAuth State Validation
Source: CVE Program / CVE List V5
Vulnerability Description
Gitify before 7.10.0 contains a login cross-site request forgery vulnerability that allows remote attackers to bind a victim's client to their account because performGitHubWebOAuth() omits OAuth state validation. Attackers can get a gitify://oauth?code= link with their own authorization code opened during a victim's pending login, causing Gitify to display attacker-controlled notifications as the victim's own.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
跨站请求伪造(CSRF)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| gitify-app | gitify | 0 ~ 7.10.0 | - |
|
II. Public POCs for CVE-2026-112050
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-112050
请登录查看更多情报信息。
Other References for CVE-2026-112050 (5)
-
https://github.com/gitify-app/gitify/issues/3425 issue-tracking
IV. Related Vulnerabilities
Same weakness: CWE-352
-
CVE-2026-111988
dyad-sh dyad OAuth Callback cross-site request forgery -
CVE-2026-111907
phpMyFAQ 4.0.0 before 4.1.9 CSRF via /admin/api/update-datab -
CVE-2026-111906
phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta CSRF -
CVE-2026-92978
User Registration & Membership <= 5.2.8 - Cross-Site Request -
CVE-2026-49410
OpenHuman /auth/telegram CSRF allows attacker-controlled ses
V. Comments for CVE-2026-112050
No comments yet