Description

BetterDesk is a remote desktop management solution. BetterDesk versions through 2.3.0 improperly invalidate deleted device identities, allowing an unauthenticated client to replay or spoof a device ID and bypass registration controls. Version 3.0.0-alpha contains a patch. No known workarounds are available.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.7",
  "pubDate": "2026-08-18T14:17:10.117Z",
  "pubdate": "2026-08-18T14:17:10.117Z",
  "executiveSummary": "BetterDesk versions through 2.3.0 suffer from an improper identity invalidation vulnerability within the device registration and management mechanism.\nThis flaw allows an unauthenticated client to successfully replay or spoof previously deleted device identities, thereby completely bypassing standard device registration controls.\nThe primary impact of this vulnerability is unauthorized access and device spoofing within the remote desktop management solution.\nThe risk implications are significant, as malicious actors can impersonate legitimate or deleted endpoints to interact with the remote desktop infrastructure without proper authorization.\nAn attacker requires no prior authentication or specialized privileges, only the ability to interact with the target network and craft requests containing replayed or spoofed device identifiers.\nNo known workarounds are currently available to secure vulnerable installations aside from applying the official software update.",
  "technicalDetails": "The root cause of the vulnerability resides in the insecure session and device lifecycle management logic within BetterDesk versions through 2.3.0.\nSpecifically, the application fails to properly purge, invalidate, or cryptographically disassociate deleted device identities from its backend database and state tracking mechanisms.\nThe vulnerable component is the device identity validation handler responsible for verifying registration states during client handshake and connection initialization routines.\nBecause authentication requirements are absent for the initial device registration validation phase, the attack vector is exposed to unauthenticated network actors with arbitrary privilege levels.\nThe attack flow proceeds as follows: First, an attacker identifies or captures a previously valid device ID associated with a deleted or decommissioned endpoint.\nSecond, the unauthenticated client crafts a connection or registration request containing the targeted device identifier.\nThird, the BetterDesk backend improperly accepts the replayed or spoofed device ID as legitimate because it fails to cross-reference the lifecycle state or cryptographically validate the identity against active records.\nConsequently, the registration controls are bypassed entirely, granting the attacking client unauthorized operational access.\nPost-exploitation impact includes unauthorized control integration, potential telemetry spoofing, and evasion of perimeter security monitoring designed to track valid endpoints."
}