The Datadog Android application has an exported launcher activity that accepts intent extras containing a UserSession, including OAuth tokens. Because this activity lacks permission checks, a co‑installed malicious application can inject a crafted session, and the app will sign in using that session without validating it against the backend. This flaw allows an attacker to switch the victim’s Datadog session to one under the attacker’s control, constituting an account‑confusion vulnerability (CWE‑926). The specifics of the vulnerability’s description may have been updated, but the core issue remains an unprotected activity that accepts arbitrary session data. Note: Updated description is not available; this summary reflects the last known details.

Any device running the Datadog Android application that contains the exported launcher activity is affected. The vulnerability applies to all installed versions of the app, and any new release that still exposes this activity without protection would remain vulnerable until a vendor patch is issued.

The attack requires only a second application on the same device, with zero installation permissions. The attacker does not need to compromise the device or gain network access; local compromise suffices. Because the vulnerability bypasses server‑side token verification, a valid OAuth token supplied by the attacker can be used by the victim’s device, enabling immediate access to the victim’s Datadog resources. No EPSS score is available. The CVSS score of 6.3 indicates moderate severity, and the vulnerability is not listed in KEV. The direct hijacking of credentials and impersonation represents a significant confidentiality and integrity threat, requiring prompt remediation.