Gitify versions prior to 7.10.0 lack OAuth state validation during the GitHub login flow, allowing attackers to bind a victim’s client to the attacker’s GitHub account. The victim is redirected to a malicious gitify://oauth link that includes an attacker‑controlled authorization code, after which Gitify displays attacker‑controlled notifications as if they originated from the victim. This flaw enables credential compromise and impersonation within the application, directly impacting the victim’s authentication state and notification integrity.

The vulnerability affects the Gitify application from the vendor gitify-app, specifically any installation running a version older than 7.10.0. Users who have not upgraded to the 7.10.0 release, which corrects the OAuth state verification, remain exposed.

The CVSS score of 2.3 indicates a low severity impact; however, the flaw requires the victim to click on a crafted link, so it is a threat that can be activated remotely but only with victim cooperation. Exploit probability is not quantified (EPSS not available) and the vulnerability is not listed in CISA KEV. Attackers can therefore use phishing or social‑engineering techniques to convince victims to open the malicious gitify://oauth link, which will bind the victim’s client to the attacker’s account and allow the attacker to view or control victim notifications.