Google DevSite Flaw Let Attackers Execute Remote Code Through Forged Flask Sessions
A patched Google DevSite flaw let unauthenticated attackers forge Flask sessions and achieve remote code execution.
Researcher Simon Koeck found that Google's shared DevSite OAuth endpoint issued readable Flask session cookies containing a serialized OAuth flow, including a client ID and client secret. That secret was also the Flask signing key, so an unauthenticated visitor could forge a trusted session. The callback passed that data to Python pickle.loads(), which can execute code; Koeck showed this with a time-delay payload rather than system commands. Google fixed the issue on October 7, 2026, awarded $90,000, rotated secrets, and moved OAuth flow state server-side. Affected sites included developers.google.com, firebase.google.com, developer.android.com, source.android.com, and docs.partner.android.com.
- Unauthenticated attackers could forge Flask session cookies on shared Google DevSite.
- The exposed OAuth client secret was reused as the Flask signing key.
- The OAuth callback unpickled session data, enabling remote code execution.
- The proof of concept only delayed responses; no system commands were run.
- Google fixed the flaw on October 7, 2026 and paid $90,000.
From the original article
3 min read at cybersecuritynews.com
A critical vulnerability in Google’s shared DevSite platform could have allowed an unauthenticated attacker to forge Flask session cookies and trigger remote code execution across several Google-owned developer websites, according to researcher Simon Koeck. The issue affected the OAuth flow used by Google developer documentation sites, including developers. google.
By Abinaya · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.