CVE-2026-86158 — Missing Authentication in the local .NET backend of Progress Telerik Fiddler Everywhere

CVE-2026-86158

Missing Authentication in the local .NET backend of Progress Telerik Fiddler Everywhere PUBLISHED

Description (CNA)

Missing authentication in the local .NET backend (Fiddler.WebUi) of Progress Software Fiddler Everywhere 8.0.2 allows a local unauthenticated attacker to mint OAuth tokens and read the machine-in-the-middle root certificate through an unauthenticated localhost HTTP and SignalR RPC channel.

Affected (CNA)

Vendor / product	Versions
Progress Software / Progress® Telerik® Fiddler® Everywhere	affected 1.0.0 before 8.2.0

CWE

CWE-306

References

https://www.telerik.com/fiddler/fiddler-everywhere/documentation/knowledge-base/kb-security-missing-authentication-for-critical-function-cve-2026-86158

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.