Datadog Android up to 5.9.1 AppActivity Intent.getUserSession improper authentication

Summaryinfo

A vulnerability classified as problematic has been found in Datadog Android up to 5.9.1. Affected by this vulnerability is the function Intent.getUserSession of the component AppActivity. Performing a manipulation results in improper authentication. This vulnerability is reported as CVE-2026-47363. The attack requires a local approach. No exploit exists.

Detailsinfo

A vulnerability, which was classified as problematic, was found in Datadog Android up to 5.9.1. This affects the function Intent.getUserSession of the component AppActivity. The manipulation with an unknown input leads to a improper authentication vulnerability. CWE is classifying the issue as CWE-287. When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

The launcher activity AppActivity in the Datadog Android application is declared android:exported="true" with launchMode="singleTask" and no permission guard. On every onCreate and onNewIntent, it invokes Intent.getUserSession(), an extension that deserializes a full UserSession — user identity, OAuth access and refresh tokens, host, organization, datacenter, and permissions — from Bundle extras keyed under the com.datadog.app.* namespace. This extension lives in the main sourceset, not a test-only sourceset, despite a misleading comment referencing internal test fixtures. Any application installed on the device can invoke the launcher with arbitrary session extras. The startup pipeline accepts the injected session, persists it to user storage, optionally rotates persisted token storage when an OAUTH_OVERRIDE_TOKEN extra is set, and performs an automatic login under the attacker-chosen identity. The session preparer returns Ready without contacting the backend whenever the injected access token is not flagged as expired-or-expiring-soon, so no server-side token introspection takes place before auto-login. Preconditions: the Datadog application installed on the victim device, and a zero-permission co-installed malicious application. The attacker must possess any OAuth access token they are willing to have the victim use, including the attacker's own Datadog tokens.

The advisory is shared at trust.datadoghq.com. This vulnerability is uniquely identified as CVE-2026-47363 since 05/19/2026. The exploitability is told to be easy. An attack has to be approached locally. Technical details are known, but no exploit is available.

Upgrading to version 5.9.2 eliminates this vulnerability.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Type

• Network Management Software

Vendor

• Datadog

Name

• Android

Version

• 5.9.0
• 5.9.1

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion