CVE-2026-50575: BetterDesk Auth Bypass Vulnerability

CVE-2026-50575 Overview

BetterDesk is a remote desktop management solution developed by UNITRONIX. CVE-2026-50575 affects BetterDesk versions through 2.3.0 and stems from improper invalidation of deleted device identities. An unauthenticated client can replay or spoof a previously deleted device ID and bypass registration controls on the signal server. The flaw is categorized under [CWE-294] Authentication Bypass by Capture-Replay. Version 3.0.0-alpha contains a patch, and no workarounds exist for affected releases.

Critical Impact
An unauthenticated attacker can replay a deleted peer identity to bypass device registration controls, exposing confidential remote desktop sessions and enabling identity spoofing across managed endpoints.

Affected Products

UNITRONIX BetterDesk versions through 2.3.0
BetterDesk signal server (betterdesk-server) peer registration API
Remote desktop deployments relying on deleted-peer identity invalidation

Discovery Timeline

2026-08-18 - CVE-2026-50575 published to the National Vulnerability Database (NVD)
2026-08-18 - Last updated in NVD database

Technical Details for CVE-2026-50575

Vulnerability Analysis

BetterDesk assigns each managed endpoint a persistent device identifier (peer ID) used to authenticate the endpoint to the signal server. When an administrator deletes a peer, the server through version 2.3.0 fails to durably invalidate that identity. A subsequent registration request replaying the deleted peer ID is accepted, effectively resurrecting the trust binding without administrator involvement.

The weakness maps to [CWE-294] Authentication Bypass by Capture-Replay. Exploitation requires network reachability to the signal server but no authentication or user interaction. Successful abuse compromises confidentiality and integrity of remote desktop sessions and can disrupt legitimate device inventory.

Root Cause

The signal server treats peer deletion as a transient state rather than a durable revocation. Deleted peer IDs remain re-registerable because the registration handler does not consult a tombstone or soft-delete state. The patch introduces a peer_registration_rejected audit action and a restore endpoint, indicating the fixed logic now rejects registrations against soft-deleted, banned, blocklisted, or renamed peer IDs.

Attack Vector

An attacker who has observed or guessed a previously deleted peer ID sends a registration request to the signal server. Because the server does not enforce a persistent deny state, the registration succeeds and the attacker-controlled client inherits the peer identity. From there, the client can interact with the management surface as a legitimate device.

// Patch excerpt: betterdesk-server/api/server.go
mux.HandleFunc("PATCH /api/peers/{id}", s.requirePermission(auth.PermDeviceEdit, s.handleUpdatePeerFields))
mux.HandleFunc("POST /api/peers/{id}/ban", s.requirePermission(auth.PermDeviceBan, s.handleBanPeer))
mux.HandleFunc("POST /api/peers/{id}/unban", s.requirePermission(auth.PermDeviceBan, s.handleUnbanPeer))
// New route added by the fix to explicitly restore soft-deleted peers
mux.HandleFunc("POST /api/peers/{id}/restore", s.requirePermission(auth.PermDeviceDelete, s.handleRestorePeer))
mux.HandleFunc("POST /api/peers/{id}/change-id", s.requirePermission(auth.PermDeviceChangeID, s.handleChangePeerID))

Source: GitHub commit f3b4df2. The patch adds an explicit restore route so re-enabling a deleted peer requires a privileged, audited action instead of an unauthenticated re-registration.

Detection Methods for CVE-2026-50575

Indicators of Compromise

Registration events for peer IDs that were previously deleted from the BetterDesk console.
New peer_registration_rejected audit entries on patched servers indicating attempted identity replays.
Unexpected reappearance of deleted devices in the peer inventory with modified hostnames or client fingerprints.

Detection Strategies

Correlate peer_deleted audit events with subsequent successful registrations sharing the same peer ID.
Alert on registrations originating from IP addresses or client versions that differ from the deleted peer's historical baseline.
Baseline the volume of peer registrations and flag bursts of registration attempts against non-existent or recently deleted IDs.

Monitoring Recommendations

Forward BetterDesk audit logs, including the new peer_registration_rejected action, to a centralized logging or SIEM platform for retention and correlation.
Monitor the /api/peers/{id} and registration endpoints for anomalous request patterns from unauthenticated sources.
Track the peer inventory delta on a daily cadence to detect out-of-band restorations.

How to Mitigate CVE-2026-50575

Immediate Actions Required

Upgrade BetterDesk to version 3.0.0-alpha or later, which contains the fix committed in f3b4df2.
Rotate peer IDs for high-value endpoints and re-enroll them under the patched server.
Restrict network exposure of the BetterDesk signal server to trusted management networks until the upgrade is completed.

Patch Information

The fix is delivered in the commit f3b4df28240694b174158335e4c0c51c8dfbe4ab and documented in GHSA-3v82-3gf8-fxx8. The patch adds an explicit POST /api/peers/{id}/restore route gated by auth.PermDeviceDelete and introduces the ActionPeerRestored and ActionPeerRegistrationRejected audit actions so that soft-deleted, banned, blocklisted, or renamed peer IDs are rejected during registration and their attempts are logged for forensic review.

Workarounds

No official workarounds are available per the GitHub Security Advisory; upgrading is required.
As a compensating control, place the signal server behind a VPN or mutual TLS gateway to limit reachability by unauthenticated clients.
Increase audit log retention and review to identify replay attempts prior to applying the patch.

bash

# Verify installed BetterDesk server version and upgrade
betterdesk-server --version
# Pull the patched release containing commit f3b4df2
git clone https://github.com/UNITRONIX/BetterDesk.git
cd BetterDesk
git checkout v3.0.0-alpha
# Rebuild and restart the signal server per deployment documentation