CVE-2026-47363
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
In versions of the Datadog Android application prior to v541-5.9.2, the exported launcher activity AppActivity accepts an attacker-supplied session (including OAuth tokens) from Intent extras with no permission guard, and signs the app into that session without validating it against the backend. This requires a malicious application co-installed on a device with the Datadog app installed, and an OAuth token the attacker is willing to load into the victim's app. Impact: A co-installed application can switch the victim's Datadog app to a session the attacker controls. This is an account-confusion issue; it does not by itself expose the victim's existing session or data.
Risk Assessment
An attacker could take control of the user's session in the Datadog app, potentially leading to unauthorized access to data or actions in the victim's account context, though it does not expose existing data.
Recommendation
Update the Datadog Android app to version v541-5.9.2 or later, which includes the fix.
Original NVD description (English source)
In versions of the Datadog Android application prior to v541-5.9.2, the exported launcher activity AppActivity accepts an attacker-supplied session (including OAuth tokens) from Intent extras with no permission guard, and signs the app into that session without validating it against the backend. This requires a malicious application co-installed on a device with the Datadog app installed, and an OAuth token the attacker is willing to load into the victim's app. Impact: A co-installed application can switch the victim's Datadog app to a session the attacker controls. This is an account-confusion issue; it does not by itself expose the victim's existing session or data.