Zyxel guest APs let a single crafted POST skip the captive portal (CVE-2026-8508)
A pre-auth flaw in Zyxel's guest Wi-Fi social login hands the browser the Facebook-side identity work, then trusts the submitted profile fields instead of validating the access token server-side. One crafted POST to social_login.cgi returned a valid session cookie with attacker-chosen identity. The WAX650S was triaged entirely by rehosting vendor firmware in user-space emulation, and Zyxel's advisory now covers 39 models.