The Datadog Android app (version 5.9.2) declares its launcher activity AppActivity as android:exported="true" with launchMode="singleTask" and no permission restrictions. On lifecycle events, it deserializes a UserSession object from Intent extras, which includes sensitive data such as user identity and OAuth tokens. Because any app on the device can invoke this activity with crafted extras, it can inject arbitrary session data. The app then persists this session and performs automatic login if the access token is not expired, without verifying the token with the backend. This allows a zero-permission malicious app to force the Datadog app to log in under an attacker-controlled identity, assuming the attacker possesses a valid OAuth token.

An attacker with a zero-permission app on the same device can cause the Datadog Android app to automatically log in as an attacker-chosen user by injecting arbitrary session data, including OAuth tokens. This bypasses normal authentication flows and server-side token validation, potentially leading to unauthorized access to the victim's Datadog account within the app context. The attack requires the attacker to have a valid OAuth token but does not require additional permissions on the victim's device.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should avoid installing untrusted applications on the same device as the Datadog Android app version 5.9.2. Vendors should restrict the exported status of the launcher activity or enforce permission checks and implement server-side token validation to prevent unauthorized session injection.