EUVD-2026-60763Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L
AV:N and PR:N confirmed by unauthenticated network registration path; AC:H reflects the prerequisite of knowing a valid deleted device ID; C:H/I:H reflect unauthorized peer access to managed endpoints.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
4DescriptionCVE.org
BetterDesk is a remote desktop management solution. BetterDesk versions through 2.3.0 improperly invalidate deleted device identities, allowing an unauthenticated client to replay or spoof a device ID and bypass registration controls. Version 3.0.0-alpha contains a patch. No known workarounds are available.
AnalysisAI
Device identity replay in UNITRONIX BetterDesk through version 2.3.0 permits unauthenticated clients to resurrect soft-deleted peer registrations by presenting a known deleted device ID, bypassing administrator-enforced device exclusion controls. The root cause is an implicit SQL upsert that cleared soft-deletion flags on any conflicting registration insert, meaning deletion was not enforced at the database layer. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the attacker know at least one device ID that was previously registered in BetterDesk and subsequently soft-deleted by an administrator. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 score of 7.7 (High) with vector AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L accurately captures the asymmetry of this vulnerability: network-accessible with no authentication required, but conditioned on the attacker possessing a deleted device ID (AC:H). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to BetterDesk 3.0.0-alpha, which contains the fix per vendor advisory GHSA-3v82-3gf8-fxx8 (https://github.com/UNITRONIX/BetterDesk/security/advisories/GHSA-3v82-3gf8-fxx8) and upstream commit f3b4df28240694b174158335e4c0c51c8dfbe4ab. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, confirm whether your organization runs UNITRONIX BetterDesk version 2.3.0 or earlier; if so, immediately implement network-level segregation restricting device registration traffic to internal networks only and disable external device registration if available. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-294 – Authentication Bypass by Capture-replay
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today