## https://sploitus.com/exploit?id=33D18165-2055-57DB-8186-A2F92B5C5BB5
# CVE-2026-8508: Zyxel Captive-Portal Bypass via Trusted Browser-Submitted Facebook Identity
This repository packages the public writeup, quick verification script, and selected supporting artifacts for `CVE-2026-8508`.
## What this is
`CVE-2026-8508` is a pre-authentication trust-boundary flaw in Zyxel captive-portal social login. The local reverse work here was anchored on `WAX650S V7.10(ABRM.4)C0`: the browser performed the Facebook-side identity step, then submitted `fb_user` and related fields to `/cgi-bin/social_login.cgi`, and the backend accepted those fields on an auth-skip surface.
Zyxel's `2026-08-04` advisory later expanded the affected scope to `39` models: `36` APs, `2` FWA7 devices, and `1` security router.
## Files
- `index.html`: standalone public-facing HTML writeup
- `writeup.md`: markdown source for the writeup
- `poc/verify_social_login.sh`: quick verifier for direct crafted POSTs to `/cgi-bin/social_login.cgi`
- `evidence/social_login_static_trust_boundary_20260501.md`: trust-boundary summary
- `evidence/social_login_client_side_trust_architecture_20260501.md`: frontend-to-backend flow notes
- `evidence/mod_auth_zyxel_social_gate_20260501.md`: auth-skip analysis
- `decomp/social_login_20260501.c`: decompiled CGI path used in the local review
## Quick verification
```bash
chmod +x poc/verify_social_login.sh
./poc/verify_social_login.sh [fb_user]
```
Expected success signal:
```text
Set-Cookie: authtok=
```
## Notes
- Authorized testing only.
- The PoC is intentionally narrow: it checks whether a crafted pre-auth POST can reach the guest-session cookie issuance path.
- The broader downstream impact discussion is documented in the writeup and evidence files rather than forced into the verifier script.
- For the deeper emulation and rehosting path, see `https://github.com/minanagehsalalma/zyxel-wax650s-research-notebook-public`.