Key points
- Researcher Simon Koeck discovered the vulnerability and received a $90,000 reward from Google.
- The issue allowed unauthenticated attackers to execute remote code via forged session cookies.
- Google patched the flaw on 7 October 2026 after receiving the report in August.
Security researcher Simon Koeck identified a critical remote code execution vulnerability in Google’s shared DevSite platform, according to Cyber Security News. The flaw permitted unauthenticated attackers to forge Flask session cookies and trigger code execution across multiple Google-owned developer websites.
Google addressed the vulnerability on 7 October 2026, following a report received in August. The company awarded Koeck $90,000 through its Vulnerability Reward Program for disclosing the issue. The bug affected the OAuth flow used by several key developer documentation sites.
Technical details of the flaw
The vulnerability stemmed from how the DevSite OAuth endpoint handled Flask session cookies. Although Flask signs cookies to prevent tampering, it does not encrypt their contents, allowing users to read stored data. Koeck found that the cookie payload contained a serialized OAuth flow object with a Google OAuth client ID and client secret.
Critically, the exposed OAuth client secret also served as the Flask session signing key. This meant anyone with a cookie could recover the secret, generate a valid signature, and create a forged session that the server would trust, bypassing primary security controls.
Affected systems and risks
The issue impacted developers.google.com, firebase.google.com, developer.android.com, source.android.com, and docs.partner.android.com. The remote code execution risk arose because the DevSite OAuth callback passed Base64-decoded session data to Python’s pickle.loads() function. Python documentation warns that unpickling untrusted data can allow malicious payloads to execute code during restoration.
What happens next
Organisations should verify that their internal documentation platforms or developer portals are not using similar configurations where secrets are embedded in client-side session data. Monitoring for unusual outbound connections from documentation servers may help detect exploitation attempts before patches are widely applied.
What to do and how to stay safe: Google
- Audit session handling mechanisms to ensure secrets are never stored in client-side cookies or tokens.
- Review any use of deserialization libraries like pickle to ensure only trusted data is processed.
- Monitor server logs for unexpected code execution or anomalous outbound network traffic.
- Ensure all developer-facing web applications are updated to the latest patched versions.
General security guidance from the Payload Report newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which Google domains were affected by this vulnerability?
The flaw affected developers.google.com, firebase.google.com, developer.android.com, source.android.com, and docs.partner.android.com.
How much did Google pay for the discovery?
Google awarded researcher Simon Koeck $90,000 through its Vulnerability Reward Program.
When was the vulnerability fixed?
Google reportedly fixed the flaw on 7 October 2026.
