Pre-Authentication Trust Boundary Vulnerability in Zyxel Social Login

CVE-2026-8508 is a pre-authentication trust-boundary vulnerability affecting the social_login.cgi component in Zyxel network devices. The vulnerability was identified during research into the WAX650S access point (V7.10(ABRM.4)C0), where the backend improperly trusted user-supplied fields, specifically the 'fb_user' parameter, submitted during the social login flow. An unauthenticated attacker can craft a POST request to '/cgi-bin/social_login.cgi' to trigger the issuance of a guest authentication cookie without performing the legitimate Facebook-side identity validation.

Zyxel released an advisory on August 4, 2026, confirming that the flaw impacts 39 models, including 36 access points, two FWA7 series devices, and one security router. The vulnerability enables an attacker with network adjacency to bypass captive portal restrictions, potentially granting unauthorized access to the network or services protected by the captive portal.

Impact

Successful exploitation allows unauthenticated attackers with network adjacency to bypass captive portal authentication. This grants the attacker a valid guest authentication cookie, enabling unauthorized network access. The vulnerability affects 39 distinct Zyxel models, increasing the risk surface for enterprise and public-facing deployments utilizing Zyxel captive portal social login features.

Recommendation

• Prioritize patching all affected Zyxel devices as identified in the manufacturer's August 4, 2026, advisory.
• Monitor logs for anomalous POST requests directed at '/cgi-bin/social_login.cgi' originating from the guest or public-facing network segments.
• Deploy network-level access control to restrict access to management and CGI interfaces from untrusted or public network interfaces.
• Verify firmware versions across the 36 affected access points, FWA7 series, and the impacted security router model.