Google DevSite Flaw Let Attackers Execute Remote Code Through Forged Flask Sessions

What happened?

A critical vulnerability in Google’s shared DevSite platform could have allowed an unauthenticated attacker to forge Flask session cookies and trigger remote code execution across several Google-owned developer websites, according to researcher Simon Koeck. The issue affected the OAuth flow used by Google developer documentation sites, including developers.google.com, firebase.google.com, developer.android.com, source.android.com, and docs.partner.android.com.

Key details

• A critical flaw in Google's DevSite platform allowed unauthenticated attackers to forge Flask session cookies and achieve remote code execution.
• Flask session cookies contained serialized OAuth flow objects with Google OAuth client ID and client secret.
• The exposed OAuth client secret was reused as the Flask session signing key, allowing attackers to forge valid session signatures.
• Google fixed the issue on October 7, 2026, after receiving the report in August and awarded the researcher $90,000.
• Remediation included rotating OAuth secrets, invalidating sessions, separating signing keys from OAuth credentials, and moving flow objects to server-side storage.

Summarised by SecOraLens from Cyber Security News. Always read the original source before acting. How SecOraLens verifies advisories.