CVE-2026-47363 Details
Description
In versions of the Datadog Android application prior to v541-5.9.2, the exported launcher activity AppActivity accepts an attacker-supplied session (including OAuth tokens) from Intent extras with no permission guard, and signs the app into that session without validating it against the backend. This requires a malicious application co-installed on a device with the Datadog app installed, and an OAuth token the attacker is willing to load into the victim's app. Impact: A co-installed application can switch the victim's Datadog app to a session the attacker controls. This is an account-confusion issue; it does not by itself expose the victim's existing session or data.
A vulnerability exists in the Datadog Android application due to the launcher activity, AppActivity, being improperly exported. The activity is declared as exported, with a singleTask launch mode, and lacks permission guards. This allows any application on the device to invoke the launcher with arbitrary session extras. The injected session, which includes sensitive information such as user identity and OAuth tokens, is automatically processed, leading to unauthorized access under the attacker's chosen identity. The vulnerability requires the Datadog application to be installed on the victim device, along with a malicious application that has no permissions.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Aug 7, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://cwe.mitre.org/data/definitions/926.html | [email protected] | |
| https://trust.datadoghq.com/?tcuUid=2e8b8fa5-39ca-43f4-9f6a-aeafafb440ef | [email protected] |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-926 | Improper Export of Android Application Components | [email protected] |
Affected Products
No affected product data is available for this CVE.
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 8, 2026 | CVE Modified | [email protected] |
| Aug 7, 2026 | CVE Modified | CISA-ADP |
| Aug 7, 2026 | New CVE Received | [email protected] |