Vulnerability-Lookup

CVE-2026-47363 (GCVE-0-2026-47363)

Vulnerability from cvelistv5 – Published: 2026-08-07 18:02 – Updated: 2026-08-08 01:05

Summary

In versions of the Datadog Android application prior to v541-5.9.2, the exported launcher activity AppActivity accepts an attacker-supplied session (including OAuth tokens) from Intent extras with no permission guard, and signs the app into that session without validating it against the backend. This requires a malicious application co-installed on a device with the Datadog app installed, and an OAuth token the attacker is willing to load into the victim's app. Impact: A co-installed application can switch the victim's Datadog app to a session the attacker controls. This is an account-confusion issue; it does not by itself expose the victim's existing session or data.

Severity

6.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-07 18:33 UTC

CWE

CWE-926 - Improper Export of Android Application Components

Assigner

hackerone mitre root

References

2 references

URL	Tags
https://cwe.mitre.org/data/definitions/926.html
https://trust.datadoghq.com/?tcuUid=2e8b8fa5-39ca…

Impacted products

1 product

Vendor	Product	Version	CPE status
Datadog	Android App	Affected: 5.9.2 , < 5.9.2 (semver)	guessed

Credits

Mark Esler (https://github.com/eslerm)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "LOW",
              "baseScore": 6.3,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "LOW",
              "integrityImpact": "LOW",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-47363",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-07T18:33:35.578365Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-07T18:34:02.670Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Android App",
          "vendor": "Datadog",
          "versions": [
            {
              "lessThan": "5.9.2",
              "status": "affected",
              "version": "5.9.2",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Mark Esler (https://github.com/eslerm)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In versions of the Datadog Android application prior to v541-5.9.2, the exported launcher activity AppActivity accepts an attacker-supplied session (including OAuth tokens) from Intent extras with no permission guard, and signs the app into that session without validating it against the backend.\r\nThis requires a malicious application co-installed on a device with the Datadog app installed, and an OAuth token the attacker is willing to load into the victim\u0027s app.\r\nImpact: A co-installed application can switch the victim\u0027s Datadog app to a session the attacker controls. This is an account-confusion issue; it does not by itself expose the victim\u0027s existing session or data."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-926",
              "description": "CWE-926 Improper Export of Android Application Components",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-08T01:05:53.203Z",
        "orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
        "shortName": "hackerone"
      },
      "references": [
        {
          "url": "https://cwe.mitre.org/data/definitions/926.html"
        },
        {
          "url": "https://trust.datadoghq.com/?tcuUid=2e8b8fa5-39ca-43f4-9f6a-aeafafb440ef"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
    "assignerShortName": "hackerone",
    "cveId": "CVE-2026-47363",
    "datePublished": "2026-08-07T18:02:35.043Z",
    "dateReserved": "2026-05-19T15:00:09.319Z",
    "dateUpdated": "2026-08-08T01:05:53.203Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-47363",
      "date": "2026-09-28",
      "epss": "0.00245",
      "percentile": "0.14119"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Android App",
                "vendor": "Datadog",
                "versions": [
                  {
                    "lessThan": "5.9.2",
                    "status": "affected",
                    "version": "5.9.2",
                    "versionType": "semver"
                  }
                ]
              }
            ],
            "source": "support@hackerone.com"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In versions of the Datadog Android application prior to v541-5.9.2, the exported launcher activity AppActivity accepts an attacker-supplied session (including OAuth tokens) from Intent extras with no permission guard, and signs the app into that session without validating it against the backend.\r\nThis requires a malicious application co-installed on a device with the Datadog app installed, and an OAuth token the attacker is willing to load into the victim\u0027s app.\r\nImpact: A co-installed application can switch the victim\u0027s Datadog app to a session the attacker controls. This is an account-confusion issue; it does not by itself expose the victim\u0027s existing session or data."
          }
        ],
        "id": "CVE-2026-47363",
        "lastModified": "2026-09-03T17:02:54.670",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "LOW",
                "baseScore": 6.3,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "LOW",
                "integrityImpact": "LOW",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "REQUIRED",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L",
                "version": "3.1"
              },
              "exploitabilityScore": 2.8,
              "impactScore": 3.4,
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-47363",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-07T18:33:35.578365Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-08-07T18:17:16.237",
        "references": [
          {
            "source": "support@hackerone.com",
            "url": "https://cwe.mitre.org/data/definitions/926.html"
          },
          {
            "source": "support@hackerone.com",
            "url": "https://trust.datadoghq.com/?tcuUid=2e8b8fa5-39ca-43f4-9f6a-aeafafb440ef"
          }
        ],
        "sourceIdentifier": "support@hackerone.com",
        "vulnStatus": "Awaiting Analysis",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-926"
              }
            ],
            "source": "support@hackerone.com",
            "type": "Secondary"
          }
        ]
      }
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "cvssV3_1": {
                  "attackComplexity": "LOW",
                  "attackVector": "NETWORK",
                  "availabilityImpact": "LOW",
                  "baseScore": 6.3,
                  "baseSeverity": "MEDIUM",
                  "confidentialityImpact": "LOW",
                  "integrityImpact": "LOW",
                  "privilegesRequired": "NONE",
                  "scope": "UNCHANGED",
                  "userInteraction": "REQUIRED",
                  "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L",
                  "version": "3.1"
                }
              },
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-47363",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-08-07T18:33:35.578365Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-08-07T18:33:57.702Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "Android App",
              "vendor": "Datadog",
              "versions": [
                {
                  "lessThan": "5.9.2",
                  "status": "affected",
                  "version": "5.9.2",
                  "versionType": "semver"
                }
              ]
            }
          ],
          "credits": [
            {
              "lang": "en",
              "type": "finder",
              "value": "Mark Esler (https://github.com/eslerm)"
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "In versions of the Datadog Android application prior to v541-5.9.2, the exported launcher activity AppActivity accepts an attacker-supplied session (including OAuth tokens) from Intent extras with no permission guard, and signs the app into that session without validating it against the backend.\r\nThis requires a malicious application co-installed on a device with the Datadog app installed, and an OAuth token the attacker is willing to load into the victim\u0027s app.\r\nImpact: A co-installed application can switch the victim\u0027s Datadog app to a session the attacker controls. This is an account-confusion issue; it does not by itself expose the victim\u0027s existing session or data."
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-926",
                  "description": "CWE-926 Improper Export of Android Application Components",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-08-08T01:05:53.203Z",
            "orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
            "shortName": "hackerone"
          },
          "references": [
            {
              "url": "https://cwe.mitre.org/data/definitions/926.html"
            },
            {
              "url": "https://trust.datadoghq.com/?tcuUid=2e8b8fa5-39ca-43f4-9f6a-aeafafb440ef"
            }
          ]
        }
      },
      "cveMetadata": {
        "assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
        "assignerShortName": "hackerone",
        "cveId": "CVE-2026-47363",
        "datePublished": "2026-08-07T18:02:35.043Z",
        "dateReserved": "2026-05-19T15:00:09.319Z",
        "dateUpdated": "2026-08-08T01:05:53.203Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-47363

Vulnerability from fkie_nvd - Published: 2026-08-07 18:17 - Updated: 2026-09-03 17:02

Severity

6.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L

Summary

References

	URL	Tags
	support@hackerone.com	https://cwe.mitre.org/data/definitions/926.html
	support@hackerone.com	https://trust.datadoghq.com/?tcuUid=2e8b8fa5-39ca-43f4-9f6a-aeafafb440ef

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "Android App",
          "vendor": "Datadog",
          "versions": [
            {
              "lessThan": "5.9.2",
              "status": "affected",
              "version": "5.9.2",
              "versionType": "semver"
            }
          ]
        }
      ],
      "source": "support@hackerone.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In versions of the Datadog Android application prior to v541-5.9.2, the exported launcher activity AppActivity accepts an attacker-supplied session (including OAuth tokens) from Intent extras with no permission guard, and signs the app into that session without validating it against the backend.\r\nThis requires a malicious application co-installed on a device with the Datadog app installed, and an OAuth token the attacker is willing to load into the victim\u0027s app.\r\nImpact: A co-installed application can switch the victim\u0027s Datadog app to a session the attacker controls. This is an account-confusion issue; it does not by itself expose the victim\u0027s existing session or data."
    }
  ],
  "id": "CVE-2026-47363",
  "lastModified": "2026-09-03T17:02:54.670",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "LOW",
          "baseScore": 6.3,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 3.4,
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-47363",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-08-07T18:33:35.578365Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-08-07T18:17:16.237",
  "references": [
    {
      "source": "support@hackerone.com",
      "url": "https://cwe.mitre.org/data/definitions/926.html"
    },
    {
      "source": "support@hackerone.com",
      "url": "https://trust.datadoghq.com/?tcuUid=2e8b8fa5-39ca-43f4-9f6a-aeafafb440ef"
    }
  ],
  "sourceIdentifier": "support@hackerone.com",
  "vulnStatus": "Awaiting Analysis",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-926"
        }
      ],
      "source": "support@hackerone.com",
      "type": "Secondary"
    }
  ]
}

GHSA-J76G-QWMQ-5GRC

Vulnerability from github – Published: 2026-08-07 18:31 – Updated: 2026-08-08 03:31

Details

The launcher activity AppActivity in the Datadog Android application is declared android:exported="true" with launchMode="singleTask" and no permission guard. On every onCreate and onNewIntent, it invokes Intent.getUserSession(), an extension that deserializes a full UserSession — user identity, OAuth access and refresh tokens, host, organization, datacenter, and permissions — from Bundle extras keyed under the com.datadog.app.* namespace. This extension lives in the main sourceset, not a test-only sourceset, despite a misleading comment referencing internal test fixtures. Any application installed on the device can invoke the launcher with arbitrary session extras. The startup pipeline accepts the injected session, persists it to user storage, optionally rotates persisted token storage when an OAUTH_OVERRIDE_TOKEN extra is set, and performs an automatic login under the attacker-chosen identity. The session preparer returns Ready without contacting the backend whenever the injected access token is not flagged as expired-or-expiring-soon, so no server-side token introspection takes place before auto-login. Preconditions: the Datadog application installed on the victim device, and a zero-permission co-installed malicious application. The attacker must possess any OAuth access token they are willing to have the victim use, including the attacker's own Datadog tokens.

Severity

6.3 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-47363"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-926"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-08-07T18:17:16Z",
    "severity": "MODERATE"
  },
  "details": "The launcher activity AppActivity in the Datadog Android application is declared android:exported=\"true\" with launchMode=\"singleTask\" and no permission guard. On every onCreate and onNewIntent, it invokes Intent.getUserSession(), an extension that deserializes a full UserSession \u2014 user identity, OAuth access and refresh tokens, host, organization, datacenter, and permissions \u2014 from Bundle extras keyed under the com.datadog.app.* namespace. This extension lives in the main sourceset, not a test-only sourceset, despite a misleading comment referencing internal test fixtures.\nAny application installed on the device can invoke the launcher with arbitrary session extras. The startup pipeline accepts the injected session, persists it to user storage, optionally rotates persisted token storage when an OAUTH_OVERRIDE_TOKEN extra is set, and performs an automatic login under the attacker-chosen identity. The session preparer returns Ready without contacting the backend whenever the injected access token is not flagged as expired-or-expiring-soon, so no server-side token introspection takes place before auto-login.\nPreconditions: the Datadog application installed on the victim device, and a zero-permission co-installed malicious application. The attacker must possess any OAuth access token they are willing to have the victim use, including the attacker\u0027s own Datadog tokens.",
  "id": "GHSA-j76g-qwmq-5grc",
  "modified": "2026-08-08T03:31:12Z",
  "published": "2026-08-07T18:31:46Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-47363"
    },
    {
      "type": "WEB",
      "url": "https://cwe.mitre.org/data/definitions/926.html"
    },
    {
      "type": "WEB",
      "url": "https://trust.datadoghq.com/?tcuUid=2e8b8fa5-39ca-43f4-9f6a-aeafafb440ef"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L",
      "type": "CVSS_V3"
    }
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-47363 (GCVE-0-2026-47363)

FKIE_CVE-2026-47363

GHSA-J76G-QWMQ-5GRC

Tags

Sightings

Nomenclature

Related by attack behaviour