Anchor framework versions from 1.0.0 up to but not including 1.0.2 contain a logic error in the TryFrom<&'a AccountInfo<'a>> implementation for Program<'a, T>. The code compares the ID of T with Pubkey::default() to decide whether to allow any executable account or a specific one. Because T defaults to () which returns Pubkey::default(), both T = () and T = System (which also uses Pubkey::default()) behave identically, allowing any executable account to be accepted when the system program ID is expected. This leads to a false assumption that the passed program is the system program, enabling attackers to pass arbitrary programs and potentially perform unauthorized CPI calls or payment bypasses. The vulnerability is addressed in Anchor 1.0.2.

The vulnerability allows an attacker to bypass the intended verification of the system program ID in Anchor programs, potentially enabling arbitrary cross-program invocations or payment bypasses. This could lead to unauthorized actions within Solana programs that rely on Anchor for system program calls. The CVSS score of 8.2 reflects a high impact with low attack complexity and no required privileges or user interaction. There are no known exploits in the wild at this time.

Anchor users should upgrade to version 1.0.2 or later, where this vulnerability is fixed. Since the vendor advisory does not explicitly state the patch availability beyond the fix in 1.0.2, users should verify with the official solana-foundation channels for the latest remediation guidance. Programs built on affected versions should be reviewed for potential misuse of system program IDs and updated accordingly.