CVE-2026-50575

BetterDesk is a remote desktop management solution. BetterDesk versions through 2.3.0 improperly invalidate deleted device identities, allowing an unauthenticated client to replay or spoof a device ID and bypass registration controls. Version 3.0.0-alpha contains a patch. No known workarounds are available.

CVSS v3 7.7 HIGH

7.7^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.2 / Impact : 5.5

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact LOW

Scope UNCHANGED

References

Link	Resource
https://github.com/UNITRONIX/BetterDesk/commit/f3b4df28240694b174158335e4c0c51c8dfbe4ab
https://github.com/UNITRONIX/BetterDesk/security/advisories/GHSA-3v82-3gf8-fxx8
https://github.com/UNITRONIX/BetterDesk/security/advisories/GHSA-3v82-3gf8-fxx8

Configurations

No configuration.

History

22 Oct 2026, 22:10

Type	Values Removed	Values Added
Summary		(es) BetterDesk es una solución de gestión de escritorio remoto. Las versiones de BetterDesk hasta la 2.3.0 invalidan incorrectamente las identidades de dispositivos eliminados, permitiendo que un cliente no autenticado reproduzca o falsifique una ID de dispositivo y omita los controles de registro. La versión 3.0.0-alpha contiene un parche. No se conocen soluciones alternativas disponibles.

Information

Published : 2026-08-18 14:17

Updated : 2026-10-22 22:10

NVD link : CVE-2026-50575

Mitre link : CVE-2026-50575

CVE.ORG link : CVE-2026-50575

JSON object : View

Products Affected

No product.

CWE

CWE-294

Authentication Bypass by Capture-replay

CWE-345

Insufficient Verification of Data Authenticity

CWE-672

Operation on a Resource after Expiration or Release

{"id": "CVE-2026-50575", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-50575", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-08-18T18:05:05.392072Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.7, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.5, "exploitabilityScore": 2.2}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "UNITRONIX", "product": "BetterDesk", "versions": [{"status": "affected", "version": "< 3.0.0-alpha"}]}]}], "published": "2026-08-18T14:17:10.117", "references": [{"url": "https://github.com/UNITRONIX/BetterDesk/commit/f3b4df28240694b174158335e4c0c51c8dfbe4ab", "source": "security-advisories@github.com"}, {"url": "https://github.com/UNITRONIX/BetterDesk/security/advisories/GHSA-3v82-3gf8-fxx8", "source": "security-advisories@github.com"}, {"url": "https://github.com/UNITRONIX/BetterDesk/security/advisories/GHSA-3v82-3gf8-fxx8", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-294"}, {"lang": "en", "value": "CWE-345"}, {"lang": "en", "value": "CWE-672"}]}], "descriptions": [{"lang": "en", "value": "BetterDesk is a remote desktop management solution. BetterDesk versions through 2.3.0 improperly invalidate deleted device identities, allowing an unauthenticated client to replay or spoof a device ID and bypass registration controls. Version 3.0.0-alpha contains a patch. No known workarounds are available."}, {"lang": "es", "value": "BetterDesk es una soluci\u00f3n de gesti\u00f3n de escritorio remoto. Las versiones de BetterDesk hasta la 2.3.0 invalidan incorrectamente las identidades de dispositivos eliminados, permitiendo que un cliente no autenticado reproduzca o falsifique una ID de dispositivo y omita los controles de registro. La versi\u00f3n 3.0.0-alpha contiene un parche. No se conocen soluciones alternativas disponibles."}], "lastModified": "2026-10-22T22:10:00.250", "sourceIdentifier": "security-advisories@github.com"}