CVE-2026-8508: Zyxel Captive-Portal Bypass via Trusted Browser-Submitted Facebook Identity

This repository packages the public writeup, quick verification script, and selected supporting artifacts for CVE-2026-8508.

What this is

CVE-2026-8508 is a pre-authentication trust-boundary flaw in Zyxel captive-portal social login. The local reverse work here was anchored on WAX650S V7.10(ABRM.4)C0: the browser performed the Facebook-side identity step, then submitted fb_user and related fields to /cgi-bin/social_login.cgi, and the backend accepted those fields on an auth-skip surface.

Zyxel's 2026-08-04 advisory later expanded the affected scope to 39 models: 36 APs, 2 FWA7 devices, and 1 security router.

Files

• index.html: standalone public-facing HTML writeup
• writeup.md: markdown source for the writeup
• poc/verify_social_login.sh: quick verifier for direct crafted POSTs to /cgi-bin/social_login.cgi
• evidence/social_login_static_trust_boundary_20260501.md: trust-boundary summary
• evidence/social_login_client_side_trust_architecture_20260501.md: frontend-to-backend flow notes
• evidence/mod_auth_zyxel_social_gate_20260501.md: auth-skip analysis
• decomp/social_login_20260501.c: decompiled CGI path used in the local review

Quick verification

chmod +x poc/verify_social_login.sh
./poc/verify_social_login.sh <device_ip> [fb_user]

Expected success signal:

Set-Cookie: authtok=

Notes

• Authorized testing only.
• The PoC is intentionally narrow: it checks whether a crafted pre-auth POST can reach the guest-session cookie issuance path.
• The broader downstream impact discussion is documented in the writeup and evidence files rather than forced into the verifier script.
• For the deeper emulation and rehosting path, see https://github.com/minanagehsalalma/zyxel-wax650s-research-notebook-public.