Skip to content
NewA calmer, faster ZeroHour
StoryVulnerabilityhigh

Google DevSite Flaw Let Attackers Execute Remote Code Through Forged Flask Sessions

2 sources · 2 articlesFirst reported Updated ()1
Merged summary · from the lead articleSummaries by Vani AI

A patched Google DevSite flaw let unauthenticated attackers forge Flask sessions and achieve remote code execution.

Researcher Simon Koeck found that Google's shared DevSite OAuth endpoint issued readable Flask session cookies containing a serialized OAuth flow, including a client ID and client secret. That secret was also the Flask signing key, so an unauthenticated visitor could forge a trusted session. The callback passed that data to Python pickle.loads(), which can execute code; Koeck showed this with a time-delay payload rather than system commands. Google fixed the issue on October 7, 2026, awarded $90,000, rotated secrets, and moved OAuth flow state server-side. Affected sites included developers.google.com, firebase.google.com, developer.android.com, source.android.com, and docs.partner.android.com.

Key facts
  • Unauthenticated attackers could forge Flask session cookies on shared Google DevSite.
  • The exposed OAuth client secret was reused as the Flask signing key.
  • The OAuth callback unpickled session data, enabling remote code execution.
  • The proof of concept only delayed responses; no system commands were run.
  • Google fixed the flaw on October 7, 2026 and paid $90,000.
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat
Vendors
Google
Products
DevSiteFlaskoauth2client
Organizations
Google

Coverage

oldest first · one row per article · UTC
  1. · 19d ago Cyber Security NewsFirst report

    Google DevSite Flaw Let Attackers Execute Remote Code Through Forged Flask Sessions

    A patched Google DevSite flaw let unauthenticated attackers forge Flask sessions and achieve remote code execution.

  2. · 19d ago Lobsters · security

    Finding a $90,000 Remote Code Execution Vulnerability in Google

    A researcher earned $90,000 for a fixed unauthenticated RCE in Google's shared developer-docs platform via Flask session pickle.