CVE-2026-47363: Medium severity Datadog Datadog Android application vulnerability
In versions of the Datadog Android application prior to v541-5.9.2, the exported launcher activity AppActivity accepts an attacker-supplied session (including OAuth tokens) from Intent extras with no permission guard, and signs the app into that session without validating it against the backend. This requires a malicious application co-installed on a device with the Datadog app installed, and an OAuth token the attacker is willing to load into the victim's app. Impact: A co-installed application can switch the victim's Datadog app to a session the attacker controls. This is an account-confusion issue; it does not by itself expose the victim's existing session or data.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Datadog Android application (AppActivity exported launcher activity)to a version that resolves this vulnerability.Fixed in v541-5.9.2
Event History
Frequently Asked Questions
What is the severity of CVE-2026-47363?
The severity of CVE-2026-47363 is assessed as 76, indicating a high risk vulnerability.
How do I fix CVE-2026-47363?
To fix CVE-2026-47363, modify the AppActivity declaration to set android:exported="false" or implement proper permission checks.
What potential impact does CVE-2026-47363 have on the Datadog Android application?
CVE-2026-47363 allows unauthorized access to user sessions, potentially leading to identity theft and data breaches.
Which version of the Datadog Android application is affected by CVE-2026-47363?
CVE-2026-47363 affects versions of the Datadog Android application prior to the patch released on or after August 7, 2026.
How can the exploit of CVE-2026-47363 be mitigated?
Mitigation of CVE-2026-47363 can be achieved by restricting the exported activities and ensuring sensitive user data is protected.