CVE-2026-50575
Received Received - Intake

Improper Device Identity Validation in BetterDesk

Publication date: 2026-08-18

Last updated on: 2026-08-18

Assigner: GitHub, Inc.

Description
BetterDesk is a remote desktop management solution. BetterDesk versions through 2.3.0 improperly invalidate deleted device identities, allowing an unauthenticated client to replay or spoof a device ID and bypass registration controls. Version 3.0.0-alpha contains a patch. No known workarounds are available.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-18
Last Modified
2026-08-18
Generated
2026-08-18
AI Q&A
2026-08-18
EPSS Evaluated
N/A
NVD
CVE-2026-50575
EUVD
EUVD-2026-60763

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
unitronix betterdesk to 2.3.0 (inc)
unitronix betterdesk *
betterdesk betterdesk to 2.3.0 (inc)
betterdesk betterdesk 3.0.0-alpha

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-672 The product uses, accesses, or otherwise operates on a resource after that resource has been expired, released, or revoked.
CWE-345 The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.
CWE-294 A capture-replay flaw exists when the design of the product makes it possible for a malicious user to sniff network traffic and bypass authentication by replaying it to the server in question to the same effect as the original message (or with minor changes).

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

BetterDesk versions through 2.3.0 improperly invalidate deleted device identities, allowing an unauthenticated client to replay or spoof a device ID and bypass registration controls. This occurs because soft-deleted peers can be silently restored through replay attacks, enabling attackers to impersonate previously deleted devices.

Detection Guidance

Check BetterDesk logs for repeated registration attempts from previously deleted device IDs. Monitor for unauthorized access events or unexpected peer restorations. Review blocklist API responses for discrepancies between blocked and active devices.

Impact Analysis

An attacker could bypass registration controls and gain unauthorized access to the system by replaying or spoofing a deleted device ID. This allows them to impersonate legitimate devices, potentially accessing sensitive data or performing actions without authentication.

Compliance Impact

This vulnerability could lead to unauthorized access, compromising data confidentiality and integrity. For GDPR, it may violate principles of data protection and user access controls. For HIPAA, it risks exposing protected health information. Compliance may be impacted due to insufficient authentication and data authenticity verification.

Mitigation Strategies

Upgrade to BetterDesk version 3.0.0-alpha or later. Disable or restrict access to the blocklist API until patched. Implement network monitoring for replayed device IDs and enforce strict device registration policies.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-50575. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart