The Soroban Rust SDK contains a macro bug that incorrectly routes contract calls. When a contract implements a trait with #[contractimpl] and also has an inherent method of the same name, the generated code mistakenly calls the inherent method instead of the trait method. If the trait method contains essential security checks such as caller verification, those checks are bypassed, allowing unauthenticated users to trigger functions that should be protected. This flaw effectively removes a layer of authorization and can lead to unauthorized state changes or other unintended contract behavior.

The vulnerability affects the Stellar rs‑soroban‑sdk, specifically all builds prior to macros versions 22.0.10, 23.5.2, and 25.1.1. Users compiling contracts with these earlier SDK releases are impacted.

The CVSS score of 7.5 reflects a high impact from an information‑system perspective, while the EPSS score of less than 1% indicates a low probability of exploitation in the wild at present. The vulnerability is not listed in the CISA KEV catalog, suggesting no known active exploitation. Attackers can trigger the flaw through the standard WASM contract interface over the network, exploiting the incorrect dispatch when trait‑based and inherent methods collide.