This vulnerability (CWE-306) exists due to missing authentication controls in the local backend of Progress Telerik Fiddler Everywhere. An unauthenticated local attacker can exploit this flaw to generate OAuth tokens and access sensitive cryptographic material, specifically the machine-in-the-middle root certificate, through unauthenticated communication channels on localhost. The affected versions are from 1.0.0 up to but excluding 8.2.0. The CVSS v3.1 score is 7.7 (high), reflecting the potential for confidentiality and integrity impact without requiring user interaction or privileges.

An attacker with local access can mint OAuth tokens and read the machine-in-the-middle root certificate, potentially enabling unauthorized access to protected resources and interception of encrypted communications. This compromises confidentiality and integrity of sensitive data handled by the application. There is no indication of availability impact or known active exploitation in the wild at this time.

No explicit patch or remediation details are provided in the input data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict local access to trusted users only to mitigate risk.