Google Paid $90,000 for Critical Bug, Then Delayed Patch for Two Months

Why Was the OAuth Secret Reused Across Systems?

Google took two months to patch an unauthenticated remote code execution flaw in its developer documentation system after security researcher Simon Köck reported the vulnerability. The flaw allowed attackers to forge session cookies and run arbitrary Python code on Google’s servers by exploiting a reused OAuth client secret stored in a Flask session cookie. DevSite, Google’s internal platform for hosting developer documentation, used the secret to sign session tokens, making it possible for anyone who extracted the secret to impersonate authenticated users and gain server access. Köck discovered the issue during routine testing of Google’s public-facing infrastructure and reported it through the company’s Vulnerability Reward Program. Google acknowledged the report and awarded him $90,000 for the critical finding, confirming the severity of the vulnerability. Despite the high reward and clear risk, the patch was not deployed for 60 days, leaving the system exposed during that window.

The delay raised concerns about internal response times even for high-severity issues identified through external reporting. Google has not publicly explained why the fix took two months to implement after the vulnerability was validated.

How Long Was the System Vulnerable After Discovery?

The OAuth client secret was improperly stored in a Flask session cookie and used to sign user sessions, a practice that violates security best practices. Reusing secrets across services increases the risk of compromise if one system is breached. In this case, the secret’s exposure allowed attackers to generate valid session cookies without needing credentials. Google’s internal documentation platform should have used unique, tightly scoped secrets for each service. The reuse suggests a lapse in configuration management or security review during DevSite’s development or maintenance. Security experts note that such flaws are preventable with proper secret handling and automated scanning tools. Google has since updated its internal guidelines to prevent similar misconfigurations.

The vulnerability remained unpatched for approximately two months after Google received the valid report from Simon Köck. During that time, anyone who could extract the OAuth secret—potentially through logging, misconfiguration, or code exposure—could have forged administrative access. While there is no evidence the flaw was exploited in the wild, the window of exposure posed a significant risk. Google’s Vulnerability Reward Program typically expects critical issues to be addressed within 30 days, making this delay notable. The company has not disclosed whether any internal monitoring detected suspicious activity during the period. Köck confirmed he received the bounty shortly after reporting but did not disclose when the fix was ultimately applied.

What was the specific risk of the OAuth secret being stored in a session cookie? Storing the OAuth secret in a session cookie allowed anyone who accessed the cookie to decode and reuse it to sign fraudulent session tokens, enabling unauthorized access and remote code execution on Google’s servers.

Frequently Asked Questions

Did Google confirm if the vulnerability was exploited before patching? Google has not stated whether the flaw was exploited in the wild; the company confirmed the vulnerability was valid and awarded the bounty but did not disclose any evidence of active exploitation during the two-month window.

What changes has Google made to prevent similar issues? Google has updated its internal security practices for managing secrets in developer platforms, including stricter controls on OAuth credential storage and improved scanning for misconfigurations in internal systems like DevSite.