{"uuid": "cf0dce37-ad6f-4ae6-84fe-3ac02f774337", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-8508", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/191954", "content": "I found this while reversing Zyxel's WAX650S firmware and following the guest Wi-Fi social-login path. The backend trusted browser-submitted Facebook identity fields instead of validating the access token server-side, letting a crafted request skip the social-authentication gate entirely. The write-up covers the bug itself, how I traced it, and the full firmware-emulation setup I used to reproduce it without the physical AP.    submitted by    /u/TheReedemer69  (https://www.reddit.com/user/TheReedemer69) \n [link] (https://minanagehsalalma.github.io/zyxel-social-login-bypass-cve-2026-8508/)   [comments] (https://www.reddit.com/r/Pentesting/comments/1vy0pnj/i_found_a_preauth_captiveportal_bypass_in_zyxel/)", "creation_timestamp": "2026-09-02T01:00:26.786204Z"}