Tuesday 13 October 2026
Morning Edition
ZOTPAPER

News without the noise

ZOTPAPER
Security

Google paid $90,000 bounty for DevSite RCE bug, then took two months to patch

Researcher discovered reused OAuth secret enabled unauthenticated code execution across seven Google domains

By LineZotpaper
Published
Read Time2 min
Google paid a researcher $90,000 for discovering a critical vulnerability in its developer documentation platform DevSite, but took two months to patch the flaw, which allowed unauthenticated remote code execution through a reused OAuth client secret.

Security researcher Simon Köck uncovered the vulnerability in Google's DevSite infrastructure, the shared platform behind developers.google.com and several sibling documentation sites. The flaw stemmed from Google reusing an OAuth client secret as the Flask session-signing key. Anyone who recovered that secret could forge a valid session cookie and execute arbitrary Python code on the server.

Köck confirmed that the same signing secret worked across seven Google domains. He demonstrated unauthenticated remote code execution (RCE) using Python's time.sleep() payload, measuring response delays to verify code execution without running shell commands or accessing data. Google ranked the vulnerability S0, its highest severity level, and awarded Köck a $90,000 bounty (a $75,000 base payout multiplied by 1.2 for exceptional report quality).

The researcher did not test whether an attacker could modify Google's developer documentation to replace installation commands or download links with malicious ones, which could enable a supply-chain attack. Google has not disclosed DevSite's process permissions or backend access, leaving the full impact unclear.

Köck reported the bug in August 2025; Google fixed it in October 2025, according to The New Stack. The patch has been deployed, and no evidence of exploitation has been reported.

§

Analysis

Why This Matters

  • The vulnerability could have allowed attackers to execute code on a Google-owned server serving developer documentation, which is trusted by millions of developers worldwide.
  • A compromised documentation page could enable supply-chain attacks if attackers replaced installation commands or download links with malicious versions.
  • The two-month patch window highlights the tension between thorough remediation and the risk of leaving critical infrastructure exposed.

Background

This is the latest in a long line of high-severity bugs in widely used platforms that stem from credential reuse or misconfiguration. Flask sessions are signed with a secret key; if that key is exposed or reused from another service, session forgery becomes possible. The pickle serialization format is known to be dangerous when used with untrusted data, as it can execute arbitrary code during deserialization. Google's DevSite powers many of its developer portals, making it a high-value target for attackers seeking to compromise the software supply chain.

Key Perspectives

Security researcher Simon Köck: He responsibly disclosed a critical flaw, stopped short of full exploitation, and received a top-tier bounty. Google: The company paid a maximum bounty and eventually patched, but the two-month delay raises questions about response times for vulnerabilities in its own infrastructure. Observers: The reuse of an OAuth secret as a session key is a basic security mistake. The extended fix time suggests the vulnerability was complex to remediate or low priority despite the S0 rating.

What to Watch

  • Whether Google publishes a post-mortem or additional details about DevSite's internal permissions.
  • If any other researchers investigate whether the same pattern exists elsewhere in Google's infrastructure.
  • How the bug bounty program handles future reports with similarly long patch windows.

Sources

Zotpaper

Written by software from the reporting listed above, scored by an automated standards desk, and published without a person reading it first. If something here is wrong, tell the editor and it will be put right.

How we workSubscribe