GHSA-429Q-FHH4-R6HJ: Account Substitution via Discriminator Bypass in Anchor InterfaceAccount

Vulnerability ID: GHSA-429Q-FHH4-R6HJ

CVSS Score: 9.1

Published: 2026-05-13

A critical vulnerability in the Anchor framework's anchor-lang crate allows account substitution attacks. The InterfaceAccount type fails to validate the 8-byte account discriminator during deserialization, permitting an attacker to supply a mismatched account type and subvert program logic.

TL;DR

Anchor versions prior to 1.0.0 skip structural discriminator checks for the InterfaceAccount type, allowing attackers to supply improperly typed accounts that bypass framework-level validation.

⚠️ Exploit Status: POC

Technical Details

CWE ID : CWE-20

Attack Vector : Network

Vulnerability Class : Account Substitution / Type Confusion

Exploit Status : Proof-of-Concept Available

CVSS v3.1 Score : 9.1

Patch Version : 1.0.0

Affected Systems

Anchor Framework

Solana Smart Contracts utilizing anchor-lang < 1.0.0

Applications implementing…