TL;DR
Get privacy and security gear delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
Security researcher Simon Koeck reports that Google fixed a remote code execution vulnerability affecting its shared DevSite platform and awarded him $90,000. His account says exposed OAuth credentials also served as Flask session-signing keys, allowing forged cookies to reach an unsafe Python pickle deserialization path. Google’s response and technical details are described in Koeck’s report; the source material does not include a statement from Google.
Google fixed a remote code execution vulnerability in its shared developer documentation platform after security researcher Simon Koeck reported it, according to his write-up. Koeck says Google awarded him $90,000; he demonstrated that a leaked OAuth client secret could also sign Flask session cookies, enabling a forged cookie to deliver data to an unsafe deserialization routine.
Koeck’s report says the issue began with OAuth sessions issued by developers.google.com. He decoded a session cookie and found an OAuth flow object containing a client ID and a client secret. According to his account, the secret was still live when he wrote the report and also matched the key used to validate the cookie’s signature.
The report describes a chain from that signing-key exposure to Python pickle deserialization. The site’s callback reportedly read an OAuth flow object from the session and passed its decoded bytes to a pickle loader. Because Koeck could create a cookie with a valid signature, he says he could supply a crafted pickle payload. He did not run commands on Google’s production systems; instead, he used payloads that requested timed delays and reported that response times tracked the selected delay.
Koeck says the shared platform meant the signing key could produce accepted sessions across Firebase, Android developer documentation, source.android.com and docs.partner.android.com. His timeline lists the report as submitted August 6, 2026, triaged and accepted the next day, a reward decision of $90,000 on August 27, and a fix on October 7. The report classifies the finding as an S0 remote code execution issue in Google’s Normal Applications (T2) program and says the payout included a 1.2 multiplier for report quality.
The reported flaw matters because it linked credential exposure to a server-side code execution path, rather than leaving the problem as a leaked secret alone. If an attacker could obtain the relevant secret and reach the affected callback, a forged session could pass the application’s signature check and supply data to the pickle loader, according to Koeck’s technical account.
The described reach across multiple documentation sites also points to the risks of a shared platform and signing key: a weakness in common infrastructure may affect several services at once. The report does not establish that anyone exploited the issue outside the researcher’s test, and Koeck says he avoided executing commands on production. Google’s stated fix and its precise scope are not included in the supplied material, so the account supports a confirmed report of remediation, not an independent audit of every affected deployment.
secure OAuth session management tools
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Flask session cookies are signed to let a server detect tampering; they are not encrypted by default. Koeck says the cookie contents were therefore readable, and that a bytes value inside the OAuth flow object decoded to a pickle containing client credentials. The critical additional finding, as he describes it, was that the client secret also validated the Flask cookie signature.
That connection made the deserialization path dangerous: the application reportedly trusted the signature before loading the supplied flow data. Koeck tested the chain with a delay-based proof of concept and several controls, including a missing cookie, an invalid signature and a valid signature without a matching flow entry. His timeline records acceptance on August 7, 2026, followed by the reward decision and later fix.
“The signing key was stored inside the object it signs.”
— Simon Koeck, security researcher
Python pickle deserialization security books
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Scope and Exploitation Evidence
The source material is Koeck’s own technical report and does not include a Google statement, an independent reproduction, or details from a public postmortem. It does not say whether Google found evidence of exploitation by others, how many users or requests may have been affected, or whether the exposed credentials were used for activity beyond the reported test.
The report names several sites on the shared platform, but does not provide a complete inventory of affected services or explain whether all deployments used the same credentials and code path. It also records that a fix was made on October 7, 2026, without describing the deployed changes or confirming whether every session signed with the exposed key was invalidated.
web application security testing tools
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Verify Rotation and Deployment Coverage
The next points to verify are whether the exposed OAuth credentials were rotated, whether sessions signed with the compromised key were revoked, and whether the fix reached every affected DevSite deployment. Koeck’s report recommends separating OAuth credentials from a high-entropy server-side Flask key, keeping OAuth flow objects on the server, and replacing pickle with a data-only format subject to schema checks.
Google has not provided a response in the supplied source material, so further confirmation of remediation details, exposure scope and any exploitation findings remains outstanding. The report’s timeline says the fix was recorded on October 7, 2026.
As an affiliate, we earn on qualifying purchases.
Key Questions
What vulnerability did Simon Koeck report?
He reported a chain in which an OAuth client secret allegedly also signed Flask session cookies, allowing forged session data to reach an unsafe pickle deserialization path and potentially execute code on the server.
Did the researcher run code on Google’s production systems?
Koeck says he did not run commands on production. He reported using payloads that requested timed delays and comparing response times to demonstrate that the server processed the payload.
Which Google services were named in the report?
Koeck says the shared DevSite key produced valid sessions on developers.google.com, firebase.google.com, developer.android.com, source.android.com and docs.partner.android.com. The report does not give a complete inventory of affected deployments.
Why was the reported reward $90,000?
Koeck’s timeline identifies the finding as an S0 remote code execution issue in Google’s Normal Applications (T2) program. He says the $90,000 award was a $75,000 base reward multiplied by 1.2 for exceptional report quality.
Is there evidence that attackers exploited the flaw?
The supplied report does not state that other attackers exploited the vulnerability. It describes Koeck’s own proof of concept; Google’s findings about possible exploitation are not included.
Source: hn
Columbus Day / Indigenous Peoples' Day Picks
long weekend sales
As an affiliate, we earn on qualifying purchases.
