The CVSS 6.3 score assigned to this vulnerability badly understates its real-world danger. The description frames it as an 'account-confusion issue' that does not expose the victim's existing session, but this language obscures what's actually happening: an attacker who tricks a user into loading a malicious OAuth token gains a man-in-the-middle position inside the victim's Datadog application instance. Every query, dashboard view, alert configuration, and drill-down the victim performs becomes observable. The victim believes they're operating in their own session while the attacker controls what they see — and critically, what they don't see.
This isn't account confusion. It's session injection with active deception capability. Because Datadog by design monitors your entire technical stack — cloud credentials, API call patterns, service topology, alert thresholds, incident response cadence — a compromised session provides reconnaissance into infrastructure that goes far beyond the Datadog account itself. An attacker in this position can observe how your organization monitors its systems, what alerts you rely on, and what incidents you're tracking. That's intelligence collection, not account inconvenience.
The prerequisite of a 'co-installed malicious app' is also less restrictive than it sounds. Android's permission model constrains what installed apps can do to each other, but doesn't meaningfully limit who can install what. A signed APK with a developer account is sufficient — this isn't a barrier against determined attackers, only casual ones.
More concerning: if the backend accepts any well-formed token without validating organizational binding or device fingerprinting, there's no anomaly detection when a session is replaced mid-stream. The victim keeps working, the attacker keeps watching, and no security event fires. This is the same pattern that's persisted across mobile session-injection vulnerabilities for years — the severity arithmetic gets re-framed downward while the underlying architectural failure remains.
What you should check: whether your Datadog mobile app is on the patched version (check vendor release notes), whether your mobile MDM or EDR can detect apps with exported components that accept intent extras from untrusted sources, and whether any session-anomaly logging exists server-side for unexpected session context changes. If you're evaluating Datadog for new deployments, make organizational session binding a requirement — the current architecture appears to lack it.