CVE-2026-50575CWE-294CWE-345CWE-672

CVE-2026-50575

High · published August 18, 2026

CVSS v3.1
7.7
EPSS
0%
Percentile
11.9
In the wild
Unconfirmed
What it is

BetterDesk is a remote desktop management solution. BetterDesk versions through 2.3.0 improperly invalidate deleted device identities, allowing an unauthenticated client to replay or spoof a device ID and bypass registration controls. Version 3.0.0-alpha contains a patch. No known workarounds are available.

The record
Technical detail
CVSS v3.1
7.7 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L
CVSS v4.0
Not supplied
EPSS
0.00221 · 11.9th percentile
Weaknesses
CWE-294 · Authentication Bypass by Capture-replay; CWE-345 · Insufficient Verification of Data Authenticity; CWE-672 · Operation on a Resource after Expiration or Release
Published
2026-08-18T18:17Z
References (3)
https://github.com/UNITRONIX/BetterDesk/commit/f3b4df28240694b174158335e4c0c51c8dfbe4ab · [email protected]https://github.com/UNITRONIX/BetterDesk/security/advisories/GHSA-3v82-3gf8-fxx8 · [email protected]https://github.com/UNITRONIX/BetterDesk/security/advisories/GHSA-3v82-3gf8-fxx8 · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 18 AUG 13:28Z
    BetterDesk has a replay behavior vulnerability when devices are deleted
    cvelistv5