Thought Leadership
An exposed signing key and insecure pickle enabled remote code execution on Google developer pages without login.
An exposed signing key in a session cookie and insecure deserialization allowed unauthorized code execution on Google servers. The DevSite documentation platform was affected.
Security researcher Simon Köck discovered a severe vulnerability on Google’s DevSite developer platform. Using manipulated session cookies, he succeeded in executing arbitrary code on the corporation’s servers without authentication (Remote Code Execution, RCE). Google classified the vulnerability as critical and awarded Köck a bug bounty of 90,000 US dollars.
Secret Signing Key in Cookie
The starting point was an analysis of the OAuth login flow on developers.google.com. Köck noticed that a Flask session cookie set there was unusually large at roughly 1,200 bytes. Because Flask cryptographically signs cookies but does not encrypt them, the researcher was able to decode the payload. Inside was a serialized Python object containing both the OAuth client ID and the associated client secret.
Upon verification, it turned out that Google used this client secret identically as the SECRET_KEY to sign the session cookie. The signing key was thus embedded directly within the data it was supposed to protect. This made it possible to forge arbitrary session data and supply it with a valid signature.
The actual code execution resulted from the interplay with the backend: Google’s OAuth callback used Python’s pickle module to deserialize the data stored in the cookie. Because pickle can execute arbitrary commands while reconstructing objects, Köck created a crafted cookie with a payload that instructed the server to pause for a defined number of seconds as a test. The delayed server responses confirmed remote code execution.
Firebase and Android Affected
Because the DevSite architecture serves as a shared platform, the vulnerability affected multiple Google developer properties, including documentation for Firebase and Android.
Köck reported the issue on August 6, 2026. Google confirmed the report the following day, paid out the bounty in late August, and completely patched the vulnerability on October 7. The incident once again underscores the risks of insecure deserialization mechanisms combined with client-exposed keys.
(Editorial Team)
