Diffbrief Engineering daily

← Wednesday, October 14, 2026SecurityVulnerability

Google developer-docs OAuth flow exposed a $90,000 RCE

simonkoeck.com 4 min read Editor score 7/10

The researcher traced Google's developer-docs OAuth flow and decoded a large, signed Flask session cookie to inspect its contents. The investigation highlights how authentication flows and session handling can expose security-critical attack surfaces.

What
A Google developer-docs OAuth session cookie exposed an OAuth client secret that also served as Flask’s session-signing key.
How
The callback unpickled session data; with the recovered key, the researcher forged a valid cookie and supplied a pickle that led to code execution.
Why it matters
The chain shows how a leaked secret can defeat session integrity and make unsafe deserialization remotely exploitable.
read flow session cookie verify Flasksignature google_oauth2_f… base64-decodethe bytes pickle.loads
A forged session cookie passes verification before its flow data reaches pickle deserialization. Sketched from the article's own text.

Read on simonkoeck.com → Hacker News · 116 comments

Discussion

Discussion is not switched on yet. Use Note above to keep your own thoughts on this story.

Headline, summary, brief and diagram are written by a model from the source's own text; the link, byline and numbers come from the source. Read the original before relying on a claim.

Your note

Private to you. Stored in this browser, and synced to your account when you are signed in.