CVE-2026-86158 — Missing Authentication in the local .NET backend of Progress Telerik Fiddler Everywhere
Missing authentication in the local .NET backend (Fiddler.WebUi) of Progress Software Fiddler Everywhere 8.0.2 allows a local unauthenticated attacker to mint OAuth tokens and r…
Published: 2026-09-29 · CVSS: 7.7 · CVSS 3.1
Missing authentication in the local .NET backend (Fiddler.WebUi) of Progress Software Fiddler Everywhere 8.0.2 allows a local unauthenticated attacker to mint OAuth tokens and read the machine-in-the-middle root certificate through an unauthenticated localhost HTTP and SignalR RPC channel.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7