Update Google Dev Sites: Flask Session Forgery RCE Patched After OAuth Secret Misuse
A researcher showed how forged Flask sessions on Google’s developer sites could run remote code. The vendor fixed the issue and paid a reward.
Key points
- Google fixed a remote code execution flaw in its DevSite platform on October 7, 2026.
- Researcher Simon Koeck found that OAuth client secrets were used as Flask signing keys.
- The bug affected multiple developer documentation sites including firebase.google.com and developers.google.com.
Google resolved a critical vulnerability in its shared DevSite platform on October 7, 2026, after researcher Simon Koeck reported the issue in August. The flaw allowed unauthenticated attackers to forge session cookies and execute remote code on several Google-owned developer websites, according to Cyber Security News.
The vulnerability stemmed from how the DevSite OAuth flow handled Flask session cookies. Flask signs cookies to prevent tampering but does not encrypt their contents, allowing users to read stored data. In this specific implementation, the session cookie contained a serialized OAuth flow object that included a Google OAuth client ID and client secret, according to the researcher.
How the Exploit Chain Worked
The security risk escalated because the exposed OAuth client secret also served as the Flask session signing key. This design choice meant the secret was effectively stored within the session data itself. Any user who obtained a cookie could decode the payload, recover the secret, and generate a new valid signature for a forged session, bypassing the primary protection against client-side tampering.
While session forgery alone might only allow value manipulation, the DevSite application’s handling of the OAuth callback created a severe execution risk. The system reportedly Base64-decoded the OAuth flow data from the session and passed it to Python’s pickle.loads() function. Python documentation explicitly warns that the pickle module is insecure and that unpickling untrusted data can lead to arbitrary code execution during the restoration process.
Which Sites Were Affected
The flaw impacted the shared infrastructure used by multiple Google developer documentation sites. According to Cyber Security News, the affected domains included developers.google.com, firebase.google.com, developer.android.com, source.android.com, and docs.partner.android.com. These sites rely on the same DevSite platform for their OAuth authentication flows, meaning the single vulnerability exposed all connected properties to the same attack vector.
Google addressed the issue after receiving the report in August 2026. The company awarded Simon Koeck $90,000 through its Vulnerability Reward Program for identifying the chain of vulnerabilities that led to remote code execution. The fix was deployed on October 7, 2026, closing the window for exploitation across the affected developer portals.
What to watch
The incident highlights the dangers of reusing secrets across different security functions, such as using an OAuth secret as a session signing key. It also underscores the risks of using unsafe deserialization methods like Python pickle on user-controlled or session-stored data. Organizations should audit their use of session cookies and ensure that signing keys are never exposed within the payloads they protect.
What to do and how to stay safe: Google
- Review your application’s session handling to ensure signing keys are never embedded in or derivable from session data.
- Avoid using unsafe deserialization libraries like Python pickle for processing data from untrusted or semi-trusted sources.
- Monitor vendor security bulletins for critical updates to shared platform components used in your development infrastructure.
- Implement strict input validation and output encoding to mitigate the impact of any potential session tampering or injection flaws.
Step-by-step guide: Multi-Factor Authentication Setup for Small Teams
General security guidance from the Shell Bulletin newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which Google sites were affected by the DevSite vulnerability?
The flaw affected developers.google.com, firebase.google.com, developer.android.com, source.android.com, and docs.partner.android.com.
Why was the Flask session cookie vulnerable to forgery?
The OAuth client secret used to sign the cookies was also stored inside the cookie payload, allowing attackers to recover the key.
Did Google pay a reward for this bug report?
Yes, Google awarded researcher Simon Koeck $90,000 through its Vulnerability Reward Program for the discovery.
