Google developer-site cookie flaw reportedly enabled remote code execution

Koeck says Google's developer sites stored an OAuth client secret in a Flask session cookie and reused it to sign the cookie. He says he forged a session carrying a pickle the available reporting and demonstrated server-side code execution through timed delays, without running commands on Google's production systems. His timeline lists a $90,000 reward and says Google fixed the issue on October 7, 2026.