Synology DiskStation Manager: Authentication Bypass via OTP (CVE-2026-18596)
An authentication bypass vulnerability in the OTP implementation of Synology DiskStation Manager (DSM) allows remote attackers with valid credentials to access arbitrary files and perform denial-of-service attacks.
CVE search metadata
CVE search record: CVE-2026-18596. Severity: high. CVSS: 8.1. KEV: no. Product: DiskStation Manager (< 7.3.2-86009-5). Brief: Synology DiskStation Manager: Authentication Bypass via OTP (CVE-2026-18596). Brief link: https://feed.craftedsignal.io/briefs/2026-11-synology-dsm-auth-bypass-cve-2026-18596/
Triage facts
Revision 1- Applicability
- DiskStation Manager (< 7.3.2-86009-5)
- Evidence
- Unknown
- Severity
- High
- Sources
- 1 public source
- Freshness
- Revision 1Nov 12, 06:13 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A2Roughly even chance
CVE-2026-18596 is an authentication bypass using an alternate path or channel vulnerability in the One-Time Password (OTP) mechanism of Synology DiskStation Manager (DSM).
Impact
Remote attackers with valid user credentials can exploit this vulnerability to read or write arbitrary files and conduct denial-of-service attacks.
Recommendation
Refer to the vendor advisory for patch guidance and affected version information.