bug-bounty

The cookie carried its key

A Flask session cookie on developers.google.com carried its own signing key, letting a researcher forge sessions and reach RCE across Google DevSite hosts.