# Google DevSite Flask Session Pickle Deserialization RCE (Unauthenticated) - OAuth Client Secret Reused as Flask SECRET_KEY

> Researcher Simon Köck disclosed an unauthenticated remote code execution flaw in Google's DevSite documentation platform. The /oauth2authorize endpoint issued a Flask session cookie containing a pickled OAuth2WebServerFlow object with the plaintext client_secret, which was also the Flask SECRET_KEY, so an attacker could forge sessions carrying malicious pickle objects that the server unpickled. Google fixed it on 2026-10-07 and paid a $90,000 VRP reward.

- **Published:** 2026-10-12T13:13:15Z
- **Last reviewed:** 2026-10-12T13:13:15Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3355
- **ID:** TL-2026-3355
- **Severity:** CRITICAL
- **Category:** VULNERABILITY
- **Status:** PATCHED
- **Detections:** 9 · **IOCs:** 14 (full data via the Threadlinqs MCP server — Purple tier)

## Description

DevSite is the shared documentation platform behind developers.google.com, firebase.google.com, developer.android.com, source.android.com and docs.partner.android.com. According to the researcher's write-up, the platform shared one signing key across seven Google domains (five are named in the sources; two are referenced but not listed).

The flaw was a chain of three weaknesses. First, an unauthenticated request to the /oauth2authorize endpoint (with a return_url parameter) returned a Flask 'session' cookie. The cookie used Flask's standard <payload>.<timestamp>.<signature> format and was zlib-compressed (leading dot in the payload, roughly 1,200 bytes). After decompression and base64 decoding it held JSON with '_permanent': true, a 'google_oauth2_csrf_token' and a 'google_oauth2_flow_<csrf>' entry whose ' b' key tagged a bytes value: a pickle-serialized oauth2client.client.OAuth2WebServerFlow object including the plaintext client_id and client_secret. Second, the client_secret was also used as the Flask SECRET_KEY: the signing key was derived with hmac.digest(client_secret, b'cookie-session', 'sha1') (itsdangerous key derivation) and the researcher reproduced the cookie signature byte-for-byte, so anyone who read the cookie could recover the key and sign arbitrary sessions - the signing key was stored inside the object it signs. Third, the OAuth callback called pickle.loads() on session data after the signature check, so a forged session containing a pickle payload (REDUCE opcode / __reduce__) ran attacker-chosen Python callables on the server.

The researcher proved code execution safely with time.sleep(N) payloads; response delay tracked the injected duration (sleep(0) 0.207s, sleep(3) 3.193s, sleep(5) 5.194s, sleep(8) 8.283s). Control tests: no cookie and a corrupted signature returned 'Invalid request'; flipping one signature character caused rejection while re-signing with the recovered secret was accepted; a valid signature with no flow entry returned 'Invalid request state'; a valid signature with a real OAuth flow reached token exchange and failed at authorization code validation. Tools used were curl, Python base64/json/zlib/hmac, pickletools.dis and a custom __reduce__ class.

Google triaged the report on 2026-08-07 and approved a $90,000 reward on 2026-08-27 ($75,000 base for Google Applications T2 severity with a 1.2x multiplier for report quality). The fix was deployed on 2026-10-07. Remediation required four changes: rotate the exposed OAuth credentials and invalidate sessions signed with them; use independent high-entropy SECRET_KEY values per instance; keep OAuth flow objects server-side with opaque session references in the cookie; and replace pickle with schema-validated data-only formats. No CVE, CVSS score, in-the-wild exploitation, threat actor or network IOCs are reported in the sources.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1059.006 Python
- T1552 Unsecured Credentials
- T1606.001 Forge Web Credentials: Web Cookies
- T1212 Exploitation for Credential Access
- T1550.004 Use Alternate Authentication Material: Web Session Cookie
- T1550.004 Use Alternate Authentication Material: Web Session Cookie

## Sources

- [How I Found a $90,000 Remote Code Execution Vulnerability in Google](https://simonkoeck.com/writeups/google-devsite-flask-session-pickle-rce)
- [Critical Google DevSite Flaw Allowed Attackers to Execute Remote Code Without Authentication](https://gbhackers.com/critical-google-devsite-flaw/)
- [Google Vulnerability Reward Program](https://bughunters.google.com/about/rules/google-friends/google-vulnerability-reward-program-rules)
- [Python pickle module documentation (security warning)](https://docs.python.org/3/library/pickle.html)
- [Flask sessions documentation](https://flask.palletsprojects.com/en/stable/quickstart/#sessions)
- [CWE-502: Deserialization of Untrusted Data](https://cwe.mitre.org/data/definitions/502.html)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3355