High priorityDisclosed

Advisory · CVE-2026-18596

Synology DSM one-time password bypass lets credentialed attackers read and write arbitrary files

Synology DiskStation Manager before 7.3.2-86009-5 and 7.4.1-90080-1 lets a remote attacker with valid user credentials bypass the one-time password check and read or write arbitrary files.

Advisory published November 12, 2026Independent summary
Vendor
Synology
Product
DiskStation Manager (DSM)
Identifier / CWE
CVE-2026-18596
CWE-288
Action timing
Immediate
ELI5

Explain it like I’m five

A Synology box can ask for a one-time code as a second check after the password. This flaw lets an attacker who already has a password take a different route around that second check, so the extra lock never gets tested.

SIMPLIFIED_ATTACK_PATH04 STEPS
  1. 01Valid credentials

    An attacker holds valid user credentials for a DSM account, for example from phishing or reuse.

  2. 02OTP step reached

    The attacker starts a login that should require a one-time password.

  3. 03Alternate path taken

    The attacker uses an alternate path or channel that skips the one-time password verification.

  4. 04Files exposed

    With the second factor bypassed, the attacker reads or writes arbitrary files and can cause denial of service.

What happened

Synology reports an authentication bypass using an alternate path or channel in the one-time password (OTP) component of DiskStation Manager (DSM) before 7.3.2-86009-5 and 7.4.1-90080-1. A remote attacker with valid user credentials can exploit it to read or write arbitrary files and conduct denial-of-service attacks. Synology rates it important at CVSS 8.1.

What to do

  1. Upgrade DSM to 7.3.2-86009-5 or 7.4.1-90080-1, matching the installed branch, or a later release.
  2. Until patched, treat any DSM password as single-factor only: rotate passwords that may have leaked and watch for logins from unfamiliar locations.
  3. Review login and OTP logs for successful logins that skipped the one-time password step.
  4. Check for unexpected file access by accounts whose passwords may be known to others.
  5. Confirm the patched DSM version is running after the upgrade.

Management note

This flaw quietly downgrades two-factor authentication to one factor, so any leaked password is enough again. It is a reminder that a second factor only helps when every login path enforces it.