Security researcher Simon Koeck disclosed that a secret exposed in Google DevSite’s OAuth session cookie was also used as the session-signing key, enabling unauthenticated remote code execution. The issue combined key reuse with server-side restoration of pickle data stored in signed cookies. According to the researcher, an August report led to a $90,000 bounty, and the flaw was fixed on October 7. Responses include rotating keys, invalidating sessions, keeping state server-side, and using safe data formats. No separate independent report was found in related searches, so the account is limited to the discloser’s explanation.