How a researcher earned a $90,000 Google bounty from a self-signed Flask cookie
lyraxana · x · 2026-10-28
Security researcher Simon Koeck details how he earned a $90,000 bug bounty from Google: the Flask session cookie on developers.google.com embedded the very OAuth clientsecret used to sign it.
- While mapping the shared OAuth flow across Google developer docs sites, he noticed an unusually large 1,200-byte Flask cookie obtainable without login
- Flask cookies are signed, not encrypted, so decoding revealed a pickle-serialized OAuth2WebServerFlow object with plaintext clientid and clientsecret
- The leaked secret enabled session forgery, escalating to remote code execution across Google's developer sites
- The writeup includes full decoding steps: base64, zlib decompression, and pickletools.dis analysis
More from Safety
- Sam Altman's World pitches Orb eye-scanning to banks, drawing sci-fi horror comparisons — rschu · 2026-10-28
- Claude Catches North Korean Supply Chain Attack Disguised as an Auth Error — banteg · 2026-10-28
- AMA: Harvard's Stephen Casper on AI safeguards, incidents and governance, Oct 28 — NeuralNomad87 · 2026-10-28
- Detection Isn't Blocking: How to Actually Verify Your AI Agent's Security Guard — shoumikgoswami · 2026-10-28
- Security Asked: Which MCP Servers Are Safe for Enterprise Use, and How Do We Govern Them? — MorePerspectived · 2026-10-28
- Report: US gov banning the term "AI" in official documents — lyraxana · 2026-10-28