How a Flask cookie leaking an OAuth secret earned a $90,000 RCE bounty from Google
evilsocket · x · 2026-10-12
Security researcher Simon Koeck found a remote code execution vulnerability in developers.google.com and earned a $90,000 bounty from Google, affecting seven Google domains.
- While mapping the OAuth flow shared by Google's developer docs sites, he noticed the Flask session cookie from /oauth2authorize was 1,200 bytes — far more than a CSRF token needs;
- Flask cookies are signed, not encrypted: decoding it (leading dot = zlib-compressed) revealed a pickle object of oauth2client.client.OAuth2WebServerFlow;
- The object contained Google's OAuth clientid and clientsecret in plaintext — the cookie carried the very secret that signed it;
- Forging sessions with the leaked secret escalated into code execution across seven Google domains.
The write-up includes the full discovery process and decoding code.
More from Safety
- OAuth isn't enough for agents: Keycard demos short-lived creds and task-based policy — AI Engineer · 2026-10-12
- Microsoft CEO calls for an AI 'emergency brake' — and Copilot users crack jokes — realsohamparekh · 2026-10-12
- Users are pasting bank statements and medical reports into cloud AI — the case for local open models — alex_verem · 2026-10-12
- LLMs cracking old ciphers means AI could bootstrap a private language beyond human oversight — paraschopra · 2026-10-12
- AI labs don't know how to align superintelligence, researcher warns Congress — LuizaJarovsky · 2026-10-12
- Google's Gmail AI scans your emails by default, faces class-action lawsuit — nikola_mr64990 · 2026-10-12