A important safety vulnerability in Google’s shared DevSite platform might have let unauthenticated attackers execute arbitrary code on Google-hosted companies by forging Flask session cookies with malicious Python pickle payloads.
Safety researcher Simon Köck found the difficulty whereas analyzing the OAuth authorization workflow utilized by Google’s developer documentation properties.
The vulnerability affected the shared infrastructure behind builders.google.com and different domains, together with Firebase, Android Developer, Android Open Supply Venture, and Accomplice Android documentation websites. Google addressed the difficulty on October 7, 2026, awarding the researcher $90,000 by its Vulnerability Reward Program.
Important Google DevSite Flaw
The assault initiated with a request to the unauthenticated /oauth2/authorize endpoint on builders.google.com. This endpoint returned a Flask session cookie that was considerably bigger than anticipated for an OAuth CSRF token and return URL.
Flask client-side session cookies are signed to make sure integrity however aren’t encrypted by default. After decoding the compressed payload, Köck discovered that the session included a serialized OAuth circulation object containing Google OAuth client_id and client_secret values.
The core challenge was much more extreme than merely exposing OAuth credentials: the OAuth shopper secret was additionally reused because the Flask SECRET_KEY used to signal session cookies.
This reuse meant that an attacker who recovered the shopper secret might generate legitimate signatures for any arbitrary session contents. Consequently, the appliance couldn’t distinguish a official cookie issued by Google from a malicious cookie crafted by an attacker.
The susceptible callback processing path retrieved the OAuth circulation object from the signed session, Base64-decoded its worth, and handed it to Python’s `pickle.hundreds()` perform.
The usage of `pickle` for deserialization presents dangers when coping with untrusted knowledge as a result of a crafted object could invoke Python features throughout deserialization.
Beneath regular circumstances, the signed Flask cookie ensured customers couldn’t alter the serialized object. Nevertheless, as a result of the signing secret was uncovered within the cookie, the belief boundary collapsed.
An attacker might create a solid session containing a managed pickle object and an identical CSRF state worth. When the server obtained the request, it validated the solid signature, retrieved the malicious object, and deserialized it.
Whereas the researcher didn’t execute system instructions in Google’s manufacturing surroundings, the proof of idea concerned utilizing `time.sleep()` payloads. The server delayed responses by attacker-chosen intervals, about three, 5, and eight seconds, exhibiting it executed the equipped Python perform.
The vulnerability wasn’t restricted to a single documentation web site, because the flawed session-signing configuration was shared throughout Google’s DevSite platform. The recovered secret reportedly generated legitimate classes for seven Google domains, together with:
- builders.google.com
- firebase.google.com
- developer.android.com
- supply.android.com
- docs.associate.android.com
This made the difficulty significantly critical: an unauthenticated attacker might provoke the OAuth circulation, recuperate the signing secret from a returned cookie, forge a malicious alternative, and set off server-side code execution with no need a Google account.
Köck reported the flaw to Google on August 6, 2026. Google triaged the report the following day, accepted it on the identical day, and selected a $90,000 reward on August 27. The ultimate remediation was deployed on October 7.
This case underscores how individually harmful errors, similar to secret publicity, key reuse, client-side state administration, and unsafe deserialization, can converge into an unauthenticated distant code execution (RCE) chain.
Replace defenses in opposition to new malware as quickly because it seems. Combine TI Feeds with knowledge from 16K SOCs.
