Description
Missing authentication in the local .NET backend (Fiddler.WebUi) of Progress Software Fiddler Everywhere 8.0.2 allows a local unauthenticated attacker to mint OAuth tokens and read the machine-in-the-middle root certificate through an unauthenticated localhost HTTP and SignalR RPC channel.
Published: 2026-09-29
Score: 7.7 High
EPSS: < 1% Very Low
KEV: No
Impact: Local Privilege Escalation and Credential Theft
Action: Apply Patch
AI Analysis

Impact

Missing authentication in the local .NET backend (Fiddler.WebUi) allows a local attacker to create OAuth tokens and read the machine‑in‑the‑middle root certificate. This enables the attacker to impersonate the user, intercept traffic, and capture credentials without needing network access or elevated privileges beyond the local account.

Affected Systems

Progress Software’s Fiddler Everywhere version 8.0.2 is vulnerable. The issue resides in the local .NET backend that listens on localhost via HTTP and SignalR RPC.

Risk and Exploitability

The CVSS score of 7.7 indicates a high severity. EPSS is not available, and the vulnerability is not listed in CISA KEV. The attack vector is inferred to be local, requiring the attacker to run code on the same machine or obtain local access. Once the attacker can reach the localhost endpoints, they can freely mint OAuth tokens and read the root certificate, effectively gaining privileged access to intercepted traffic.

Generated by OpenCVE AI on September 29, 2026 at 07:21 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update Fiddler Everywhere to a patched release that addresses authentication in the Fiddler.WebUi backend.
  • Disable or restrict access to the local .NET backend if Fiddler Web UI is not required for your workflow.
  • Configure a firewall or host‑based ACL to block or limit local HTTP and SignalR connections to the Fiddler Web UI endpoints.

Generated by OpenCVE AI on September 29, 2026 at 07:21 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 30 Sep 2026 17:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 30 Sep 2026 15:30:00 +0000

Type Values Removed Values Added
References

Wed, 30 Sep 2026 14:30:00 +0000

Type Values Removed Values Added
References

Tue, 29 Sep 2026 13:30:00 +0000

Type Values Removed Values Added
First Time appeared Progress Software
Progress Software progress Telerik Fiddler Everywhere
Vendors & Products Progress Software
Progress Software progress Telerik Fiddler Everywhere

Tue, 29 Sep 2026 06:45:00 +0000

Type Values Removed Values Added
Description Missing authentication in the local .NET backend (Fiddler.WebUi) of Progress Software Fiddler Everywhere 8.0.2 allows a local unauthenticated attacker to mint OAuth tokens and read the machine-in-the-middle root certificate through an unauthenticated localhost HTTP and SignalR RPC channel.
Title Missing Authentication in the local .NET backend of Progress Telerik Fiddler Everywhere
Weaknesses CWE-306
References
Metrics cvssV3_1

{'score': 7.7, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N'}

Subscriptions

Progress Software Progress Telerik Fiddler Everywhere
cve-icon MITRE

Status: PUBLISHED

Assigner: ProgressSoftware

Published:

Updated: 2026-09-30T15:28:20.211Z

Reserved: 2026-09-05T09:09:33.404Z

Link: CVE-2026-86158

cve-icon Vulnrichment

Updated: 2026-09-30T15:27:26.474Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-09-29T07:16:35.520

Modified: 2026-09-30T16:19:21.907

Link: CVE-2026-86158

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-29T13:19:13Z

Weaknesses
  • CWE-306

    Missing Authentication for Critical Function