The vulnerability stems from improper handling of the 'return' URL parameter across multiple calendar components. The pre-patch code directly embedded user-supplied 'return' values into redirect URLs without encoding or validation. Functions like calendar_filter_controls and filter_selection_table constructed URLs using moodle_url with raw 'return' parameters, allowing attackers to craft malicious redirects. The patch introduced base64 encoding/decoding and sesskey validation, confirming the original implementation lacked these critical security measures. The affected functions all participated in the vulnerable redirect chain by passing unvalidated URLs.