The vulnerability stems from the Page_Load function in FeedProxy.aspx.cs, which handled the 'url' parameter. The pre-patch code validated the host via an XML allowlist but did not restrict the port. The commit 924a016 added a 'requestUri.Port == 80' check to mitigate this. The absence of port validation in the original implementation allowed SSRF via non-80 ports, as confirmed by the CVE description and exploit examples targeting ports 25/8080.