The vulnerability stems from the verify function's lack of algorithm validation prior to the patch. The commit diff shows the addition of critical checks: 1) auto-populating options.algorithms based on key type (asymmetric vs symmetric), and 2) validating the header's alg against this whitelist. Before this fix, the function blindly trusted the attacker-controlled alg header field, allowing algorithm confusion attacks. The NVD description explicitly references this weakness in algorithm validation (CWE-20), and the commit directly modifies the verify function to address it.