Source: Technical post-mortem by security researcher Simon Koeck published on October 12, 2026.
While analyzing the OAuth flow across developers.google.com, Koeck noticed an unusually large 1,200-byte Flask session cookie. Decoding the zlib-compressed payload revealed a serialized OAuth2WebServerFlow object containing Google's OAuth client_id and client_secret in plaintext. Computing the itsdangerous HMAC-SHA1 signature using the discovered client secret matched the cookie signature byte-for-byte, confirming the secret was signing itself.
Because the callback endpoint deserialized the flow state using Python's pickle.loads, possessing the signing key enabled arbitrary object injection. Koeck constructed proof-of-concept cookies using Python's __reduce__ method targeting time.sleep(N), observing server response latencies scale precisely with the injected sleep parameters (from 0.207 seconds at sleep 0 to 8.283 seconds at sleep 8).
The shared architecture magnified the impact: because the DevSite engine powers multiple developer properties, the forged sessions were valid across firebase.google.com, developer.android.com, source.android.com, and docs.partner.android.com. Koeck reported the issue on August 6, 2026; Google triaged it within ten hours, accepted the finding that afternoon, and deployed full remediation on October 7, 2026.
Limits: Koeck strictly adhered to responsible disclosure guidelines, confirming RCE via controlled timing side-channels without executing arbitrary shell commands or exfiltrating production data. Google has not reported any evidence of in-the-wild exploitation prior to patching.