Finding a $90,000 Remote Code Execution Vulnerability in Google
A researcher earned $90,000 for a fixed unauthenticated RCE in Google's shared developer-docs platform via Flask session pickle.
A bug-bounty write-up describes a now-fixed unauthenticated remote code execution issue in Google's shared DevSite platform, including developers.google.com and firebase.google.com. Signed but unencrypted Flask session cookies contained a pickle-serialized OAuth flow and a live OAuth client secret that also validated the session signature, so a forged cookie could reach pickle deserialization. The researcher demonstrated server-side execution only with time delays and did not run commands. Google triaged the 6 August 2026 report, fixed it on 7 October 2026, and paid $90,000.
- Google DevSite Flask session cookies were signed but not encrypted.
- A live OAuth client secret in the cookie also verified the session signature.
- The researcher showed deserialization only with timed delays, not commands.
- The same key signed sessions across multiple Google developer documentation sites.
- Google fixed the issue and awarded a $90,000 bounty.
- Vendors
- Products
- DevSiteFlaskoauth2client
- Organizations
From the original article
4 min read at simonkoeck.com
I was mapping the OAuth flow that Google’s developer docs sites all share. You hit /oauth2authorize , it sets a Flask session cookie and redirects you to Google’s sign-in page. No account needed: 'https://developers.
By simonkoeck.com via hoistbypetard · simonkoeck.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.