Researcher Earns $90,000 for Remote Code Execution Flaw in Google Developer Sites

Leaked OAuth Credentials in Session Cookies

Security researcher Simon Koeck discovered that the OAuth flow shared across Google's developer documentation sites exposed sensitive credentials directly in Flask session cookies. Visiting /oauth2authorize on developers.google.com sets a session cookie that is signed but not encrypted, meaning anyone holding the cookie can decode its contents.

Inside the cookie, Koeck found a pickle-serialized oauth2client.client.OAuth2WebServerFlow object containing a live Google OAuth client_id and client_secret in plaintext. More critically, the same client secret also served as the Flask SECRET_KEY used to sign the cookies themselves. He confirmed this by recomputing the signature offline using HMAC with the cookie-session key derivation, producing a result byte-for-byte identical to the signature on the issued cookie.

From Forged Cookie to Remote Code Execution

With the signing key recovered, Koeck could craft arbitrary session cookies that the server would accept as valid. The OAuth callback reads the flow object back from the session and passes it to pickle.loads, which executes code during unpickling through the REDUCE opcode.

Rather than running commands on Google's production systems, Koeck proved the flaw with timing. A payload reducing to time.sleep(N) produced response delays matching the chosen value: 0.207 seconds for sleep(0), 3.193 for sleep(3), 5.194 for sleep(5), and 8.283 for sleep(8). Control tests confirmed the behavior: a missing cookie, a flipped signature byte, or a missing flow entry all returned "Invalid request," while the sleep payload delayed the response by exactly the requested number.

Impact and Reward

The vulnerability affected the shared DevSite platform, so the recovered key signed valid sessions on firebase.google.com, developer.android.com, source.android.com, and docs.partner.android.com. Google accepted the report and awarded $90,000, calculated as a $75,000 base for a normal Google Applications RCE multiplied by 1.2 for exceptional report quality. The report was submitted on August 6, 2026, triaged and accepted on August 7, and fixed on October 7, 2026.

The Fix

Google applied four layered changes: rotating both exposed OAuth client secrets and invalidating sessions signed with them, giving each deployment its own high-entropy Flask SECRET_KEY from a server-side store unrelated to OAuth credentials, keeping the OAuth flow object on the server with cookies holding only an opaque reference, and replacing pickle with a schema-checked data-only format for anything crossing a client boundary. Any single change would have broken the attack chain.

Sources: simonkoeck.com