Skip to content
Google's $90k RCE Vulnerability Exposed in Developer Documentation

Google's $90k RCE Vulnerability Exposed in Developer Documentation

First seen 13 Oct 2026, 05:55 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 13, 2026 at 06:56 UTC
  • •A remote code execution vulnerability in Google DevSite allowed unauthenticated access.
  • •The flaw was due to a reused OAuth client secret in a Flask session cookie.
  • •Google awarded a $90,000 bounty for the discovery, but took two months to patch.

A remote code execution (RCE) vulnerability was discovered in Google's DevSite infrastructure, which affected seven domains including developers.google.com and firebase.google.com. The flaw stemmed from a reused OAuth client secret stored in a Flask session cookie, allowing attackers to forge valid cookies and execute arbitrary Python code on the server. The vulnerability was rated S0, the highest severity level, and the finder, Simon Köck, was awarded a $90,000 bounty for the report. Google took two months to patch the vulnerability, which involved rotating secrets and improving session key management. Concerns remain regarding potential access to internal services and the possibility of supply-chain attacks, although Köck did not test for write access to content systems. The vulnerability highlights risks associated with using insecure serialization methods like pickle in web applications.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2026-08-13
Vulnerability discovered
Simon Köck reported a critical RCE vulnerability in Google's DevSite infrastructure.
Daily.Dev
2026-10-13
Vulnerability patched
Google announced the patch for the RCE vulnerability after two months of delay.
Thenewstack

More articles in this cluster (2)

Following this threat?

Track Google in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (8)

1 / 3

Common questions

What systems are affected?
The vulnerability affects seven Google domains, including developers.google.com and firebase.google.com.
How was the vulnerability exploited?
Attackers could forge session cookies using a leaked OAuth client secret, leading to unauthenticated remote code execution.
What remediation steps did Google take?
Google rotated the OAuth secrets, improved session key management, and dropped insecure serialization methods.