Google “Won’t Fix” API key staying active for 23 mins after deletion
Deleted Google API keys remain valid for up to 23 minutes after revocation, potentially allowing attackers to continue accessing Google Cloud services and Gemini data long after the credentials have been disabled. Google acknowledged the behavior following a report by Aikido, but closed the report as “won’t fix,” describing the propagation delay as an expected … The post Google “Won’t Fix” API key staying active for 23 mins after deletion appeared first on CyberInsider.
Google API keys remain valid for up to 23 minutes after deletion, allowing attackers to access Google Cloud services and Gemini data during this time. This delay in revocation creates a window of opportunity for threat actors to exploit compromised credentials.
Read the full article
This is a curated summary. The complete article is available at Cyber Insider.