Critical Google DevSite Flaw Allowed Attackers to Execute Remote Code Without Authentication
Researcher Simon Köck found an unauthenticated RCE chain in Google DevSite via Flask session cookie forgery and unsafe pickle deserialization, earning $90,000.
Security researcher Simon Köck discovered a critical unauthenticated RCE vulnerability in Google's shared DevSite platform affecting developers.google.com, firebase.google.com, developer.android.com, source.android.com, and three other domains. The flaw stemmed from the OAuth client_secret being reused as the Flask SECRET_KEY for session cookie signing, and that secret was embedded in the cookie itself, allowing an attacker to forge valid cookies containing malicious Python pickle payloads for deserialization-based code execution. Köck demonstrated execution using time.sleep() delays of three, five, and eight seconds. Google patched the issue on October 7, 2026, and awarded $90,000 through its Vulnerability Reward Program.
- OAuth client_secret reused as Flask SECRET_KEY, exposed inside signed session cookies
- Forged cookies with pickle payloads enabled unauthenticated RCE across seven Google domains
- Researcher demonstrated code execution via time.sleep() PoC without running system commands
- Google patched on October 7, 2026; $90,000 bounty awarded to Simon Köck
From the original article
2 min read at gbhackers.com
A critical security vulnerability in Google’s shared DevSite platform could have let unauthenticated attackers execute arbitrary code on Google-hosted services by forging Flask session cookies with malicious Python pickle payloads. Security researcher Simon Köck discovered the issue while analyzing the OAuth authorization workflow used by Google’s developer documentation properties.
By Divya · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.