CVE-2026-47363: Improper Export of Android Application Components

In versions of the Datadog Android application prior to v541-5.9.2, the exported launcher activity AppActivity accepts an attacker-supplied session including OAuth tokens from Intent extras with no permission guard, and signs the app into that session without validating it against the backend. Th...

PT-2026-69091

Name of the Vulnerable Software and Affected Versions Datadog Android application versions prior to 5.9.2 Description The launcher activity AppActivity is declared as exported with launchMode="singleTask" and lacks a permission guard. The application invokes Intent.getUserSession during onCreate...