oauth2client

Google Paid $90,000 for a Remote Code Execution Vulnerability in DevSite, Then Fixed It Two Months Later

Simon Köck discovered an undocumented remote code execution vulnerability in Google DevSite’s architecture, caused by reusing an OAuth secret as a key to sign Flask sessions alongside unsafe deserialization of Python data. Google classified the vulnerability as S0 and paid a $90,000 bounty, but did not deploy the fix until two months after it was reported.