CVE-2026-47363
Received Received - Intake

Session Hijacking in Datadog Android App

Publication date: 2026-08-07

Last updated on: 2026-08-07

Assigner: HackerOne

Description
The launcher activity AppActivity in the Datadog Android application is declared android:exported="true" with launchMode="singleTask" and no permission guard. On every onCreate and onNewIntent, it invokes Intent.getUserSession(), an extension that deserializes a full UserSession — user identity, OAuth access and refresh tokens, host, organization, datacenter, and permissions — from Bundle extras keyed under the com.datadog.app.* namespace. This extension lives in the main sourceset, not a test-only sourceset, despite a misleading comment referencing internal test fixtures. Any application installed on the device can invoke the launcher with arbitrary session extras. The startup pipeline accepts the injected session, persists it to user storage, optionally rotates persisted token storage when an OAUTH_OVERRIDE_TOKEN extra is set, and performs an automatic login under the attacker-chosen identity. The session preparer returns Ready without contacting the backend whenever the injected access token is not flagged as expired-or-expiring-soon, so no server-side token introspection takes place before auto-login. Preconditions: the Datadog application installed on the victim device, and a zero-permission co-installed malicious application. The attacker must possess any OAuth access token they are willing to have the victim use, including the attacker's own Datadog tokens.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-07
Last Modified
2026-08-07
Generated
2026-08-07
AI Q&A
2026-08-07
EPSS Evaluated
N/A
NVD
CVE-2026-47363
EUVD
EUVD-2026-54568

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
datadog datadog_android_application *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-926 The Android application exports a component for use by other applications, but does not properly restrict which applications can launch the component or access the data it contains.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The Datadog Android app's launcher activity is vulnerable due to being exported without permission checks. It accepts arbitrary session data from other apps, allowing an attacker to inject OAuth tokens and force an automatic login under their identity without server-side validation.

Detection Guidance

This vulnerability involves a misconfigured Android activity in the Datadog app that allows unauthorized session injection. Detection requires checking the Datadog app's manifest for exported activities with launchMode=singleTask and no permission guards. Inspect the app's code for Intent.getUserSession() usage in onCreate or onNewIntent methods.

Impact Analysis

An attacker could gain unauthorized access to your Datadog account by tricking you into running a malicious app. They could impersonate you, access sensitive data, or perform actions under your identity without your knowledge.

Compliance Impact

This vulnerability could lead to unauthorized data access or breaches, violating GDPR's data protection requirements and HIPAA's safeguards for sensitive health information. Organizations using Datadog may face compliance violations and legal penalties.

Mitigation Strategies

Update the Datadog Android application to the latest version if a patch is available. Review installed apps for untrusted applications and remove suspicious ones. Monitor for unauthorized logins or token usage in Datadog's admin console.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-47363. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart