CVE-2026-50575 BetterDesk has a replay behavior vulnerability when devices are deleted
Unauthenticated attackers can replay or spoof deleted device IDs to bypass registration controls in BetterDesk remote desktop software.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-50575?
CVE-2026-50575 is a high-severity authentication bypass vulnerability in UNITRONIX BetterDesk, published on 18 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
BetterDesk is a remote desktop management solution. BetterDesk versions through 2.3.0 improperly invalidate deleted device identities, allowing an unauthenticated client to replay or spoof a device ID and bypass registration controls. Version 3.0.0-alpha contains a patch. No known workarounds are available.
Which versions are affected by CVE-2026-50575?
How do I fix CVE-2026-50575?
No fix has been published for CVE-2026-50575 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-50575 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-50575 exists.
Sources
Also known as GHSA-3v82-3gf8-fxx8.