CVE-2026-47363

Received Received - Intake

Session Hijacking in Datadog Android App

Publication date: 2026-08-07

Last updated on: 2026-08-08

Assigner: HackerOne

Description

In versions of the Datadog Android application prior to v541-5.9.2, the exported launcher activity AppActivity accepts an attacker-supplied session (including OAuth tokens) from Intent extras with no permission guard, and signs the app into that session without validating it against the backend. This requires a malicious application co-installed on a device with the Datadog app installed, and an OAuth token the attacker is willing to load into the victim's app. Impact: A co-installed application can switch the victim's Datadog app to a session the attacker controls. This is an account-confusion issue; it does not by itself expose the victim's existing session or data.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-07

Last Modified

2026-08-08

Generated

2026-08-28

AI Q&A

2026-08-07

EPSS Evaluated

2026-08-26

NVD

CVE-2026-47363

EUVD

EUVD-2026-54568

Affected Vendors & Products

Vendor	Product	Version / Range
datadog	datadog_android_application	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-926	The Android application exports a component for use by other applications, but does not properly restrict which applications can launch the component or access the data it contains.

Attack-Flow Graph

Executive Summary

The Datadog Android app's launcher activity is vulnerable due to being exported without permission checks. It accepts arbitrary session data from other apps, allowing an attacker to inject OAuth tokens and force an automatic login under their identity without server-side validation.

Detection Guidance

This vulnerability involves a misconfigured Android activity in the Datadog app that allows unauthorized session injection. Detection requires checking the Datadog app's manifest for exported activities with launchMode=singleTask and no permission guards. Inspect the app's code for Intent.getUserSession() usage in onCreate or onNewIntent methods.

Impact Analysis

An attacker could gain unauthorized access to your Datadog account by tricking you into running a malicious app. They could impersonate you, access sensitive data, or perform actions under your identity without your knowledge.

Compliance Impact

This vulnerability could lead to unauthorized data access or breaches, violating GDPR's data protection requirements and HIPAA's safeguards for sensitive health information. Organizations using Datadog may face compliance violations and legal penalties.

Mitigation Strategies

Update the Datadog Android application to the latest version if a patch is available. Review installed apps for untrusted applications and remove suspicious ones. Monitor for unauthorized logins or token usage in Datadog's admin console.

Hi! I’m here to help you understand CVE-2026-47363. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70