Google DevSite (Simon Koeck, disclosed 12 Oct): Flask session cookie carried the OAuth client secret used as SECRET_KEY — forged session → pickle RCE across Google developer sites; fixed 7 Oct, $90k VRP
Independent researcher Simon Koeck published on 12 October 2026 a write-up of a critical chain in Google's shared DevSite platform (the Flask/OAuth front end used by Google developer documentation sites). A /oauth2authorize response set a large Flask session cookie that was signed but not encrypted. Decoding it exposed a pickle-serialized OAuth2WebServerFlow object holding a Google OAuth client_id and client_secret in cleartext; that same client_secret was the Flask SECRET_KEY (itsdangerous cookie-session derivation), so anyone with a cookie could recover the key, forge a valid session, and smuggle a malicious pickle into the OAuth callback's pickle.loads path for remote code execution. Koeck showed the developers.google.com signing key also validated sessions on other DevSite hosts including firebase.google.com, developer.android.com, source.android.com and docs.partner.android.com. Timeline: reported 6 Aug 2026, triaged/accepted 7 Aug, $90,000 VRP reward decided 27 Aug (T2 S0 RCE base $75,000 × 1.2), fixed 7 Oct 2026. Google's fix path, per the write-up: rotate the exposed OAuth secrets and kill sessions signed with them; give each deployment its own high-entropy Flask SECRET_KEY unrelated to OAuth; keep the OAuth flow object server-side with only an opaque reference in the cookie; and stop unpickling client-supplied data. No evidence of exploitation in the wild was published. Primary: Simon Koeck write-up (12 Oct); wire: Cybersecurity News (12 Oct).
- Product
- Google DevSite shared platform (Flask session + OAuth) on Google developer documentation sites
- Versions
- Fixed by Google on 7 October 2026 (per researcher timeline). Customer-managed product versions n/a — Google-hosted sites.
- Exploited in Australia?
- unknown
- Patch to
- No customer patch: Google fixed the hosted DevSite platform on 7 Oct 2026. Engineering takeaway for anyone shipping Flask apps: never reuse an OAuth client secret as SECRET_KEY, never put pickle blobs in client cookies, and treat session cookies as readable by the bearer.
Primary: Simon Koeck — How I Found a $90,000 Remote Code Execution Vulnerability in Google (12 Oct 2026) · Cybersecurity News — Google DevSite flaw let attackers execute remote code through forged Flask sessions (12 Oct 2026)