Gitify before 7.10.0 contains a login cross-site request forgery vulnerability that allows remote attackers to bind a victim's client to their…
Gitify before 7.10.0 contains a login cross-site request forgery vulnerability that allows remote attackers to bind a victim's client to their account because performGitHubWebOAuth() omits OAuth state validation. Attackers can get a gitify://oauth?code= link with their own authorization code opened during a victim's pending login, causing Gitify to display attacker-controlled notifications as the victim's own.
Read at NIST National Vulnerability Database (CVE API 2.0)
- Vendor
- GitHub
- Product
- github
- CVSS
- 3.1
Why it ranks 0 (Routine)
- No intrinsic risk signals yet; rank reflects source class and recency only.
- Recency: items published within 24 hours gain 15, within 72 hours 6, within 7 days 2.