CVE-2026-112050EPSS p3.5%

CVE-2026-112050CVE-2026-112050

Description

Gitify before 7.10.0 contains a login cross-site request forgery vulnerability that allows remote attackers to bind a victim's client to their account because performGitHubWebOAuth() omits OAuth state validation. Attackers can get a gitify://oauth?code= link with their own authorization code opened during a victim's pending login, causing Gitify to display attacker-controlled notifications as the victim's own.

Scoring

CVSS 3.1 ()
VectorCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N
EPSS0.15% probability of exploitation · percentile 3.5% · 2026-10-19T12:00:27Z
Last modified2026-10-19
Sourced from NVD + FIRST.org EPSS. Curated for EU compliance use cases by Adam Lundqvist, Founder at SQUR.