The vulnerability stems from the flush() methods creating new empty sessions after clearing session data. The GitHub commit diff shows both functions were modified to remove the 'self.create()' call and instead set '_session_key = None', explicitly preventing empty session creation. The CVE description, commit message, and patch context all confirm these functions were the root cause. The SessionMiddleware changes (to avoid creating empty sessions) complement the fix but are not the primary vulnerable functions.