GoKawiilResearcher finds $90k RCE flaw via leaked Flask secret on Google developer sites
A security researcher discovered that Flask session cookies on developers.google.com embedded Google's own OAuth client_id and client_secret in plaintext, inside a pickle-serialized payload. The researcher found that this same client_secret also functioned as the Flask app's SECRET_KEY, meaning anyone who extracted it could forge valid session cookies and execute arbitrary code across seven Google domains. Google reportedly paid a $90,000 bounty for the finding.
GoKawiil's interpretation of the reporting above, not reported fact.
Using a single secret both as an OAuth credential and as a cookie-signing key is a known anti-pattern that collapses two separate trust boundaries into one, so compromise of one immediately compromises the other. The use of Python's pickle for session data is especially risky since deserializing attacker-controlled pickles can lead directly to remote code execution, which likely explains the unusually high payout.
- Flask session cookies are signed but not encrypted, so embedding secrets inside them exposes those secrets to anyone who can read the cookie.
- Reusing a sensitive secret (OAuth client_secret) as a Flask SECRET_KEY lets a leak in one system compromise an unrelated system.
- Storing pickled Python objects in user-accessible cookies creates a direct path to remote code execution if the signing key is ever recovered.
Source: simonkoeck.com — Simon Koeck, 2026-10-12
Published there as: “I Found a $90k Remote Code Execution Vulnerability in Google”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.