This vulnerability (CWE-749) in Progress Telerik Fiddler Everywhere prior to 8.2.0 allows a local, low-privileged attacker to exploit exposed privileged IPC methods by modifying application launch parameters and persuading a user to launch the application. The attacker can replace the application UI or settings with malicious content, potentially disclosing OAuth authentication tokens, executing locally accessible programs, or modifying configuration files generated by the application. The CVSS 3.1 score is 5.6 (medium severity) with attack vector local, low complexity, low privileges required, user interaction required, and high confidentiality impact.

Successful exploitation can lead to disclosure of sensitive OAuth authentication tokens, unauthorized execution of local programs, and unauthorized modification of application configuration files. This compromises confidentiality and integrity of the application environment but does not affect availability.

A fix is available in Progress Telerik Fiddler Everywhere version 8.2.0. Users should upgrade to version 8.2.0 or later to remediate this vulnerability. No additional mitigation guidance is provided by the vendor advisory.