Security researcher Simon Koeck discovered a $90,000 bounty Remote Code Execution vulnerability in Google's developer documentation sites. The issue involved Flask session cookies containing pickle-serialized data along with leaked OAuth client credentials and secret keys, allowing potential authentication bypass.
Background
Google's developer documentation sites share a common OAuth authentication flow using Flask sessions. This finding highlights risks of unsafe deserialization and credential management in web applications.
- Source
- Lobsters
- Published
- Oct 12, 2026 at 10:40 PM
- Score
- 7.0 / 10