Google patched critical remote code execution flaw in DevSite platform

A critical vulnerability in Google’s DevSite platform, which hosts several developer documentation sites, could have allowed unauthenticated attackers to execute remote code. The flaw was discovered by Simon Koeck, a software engineer at Otark GmbH, who identified that Google had reused an OAuth client secret as the Flask session-signing key.

Because Flask session cookies are signed but not encrypted, the exposed secret allowed an attacker to decode the payload, recover the signing key, and forge valid sessions. This could have enabled remote code execution (RCE) on servers hosting sites such as developers.google.com, firebase.google.com, and various Android developer domains.

Google assigned the vulnerability an S0 severity rating, the highest on its scale, and awarded Koeck a $90,000 bounty through its Vulnerability Reward Program. The company reportedly patched the flaw on October 7, 2026, following the initial report in August.