Vulnerability · Published Aug 7, 2026 · Assigned by hackerone
CVE-2026-47363
Medium 6.3
In plain English
A medium-severity security flaw in Android App from Datadog. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 18% of all known vulnerabilities).
Official description
In versions of the Datadog Android application prior to v541-5.9.2, the exported launcher activity AppActivity accepts an attacker-supplied session (including OAuth tokens) from Intent extras with no permission guard, and signs the app into that session without validating it against the backend. This requires a malicious application co-installed on a device with the Datadog app installed, and an OAuth token the attacker is willing to load into the victim's app. Impact: A co-installed application can switch the victim's Datadog app to a session the attacker controls. This is an account-confusion issue; it does not by itself expose the victim's existing session or data.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Datadog | Android App | 5.9.2 – before 5.9.2 |
Weakness: CWE-926 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L