The vulnerability stems from CookieRememberMeManager using default cryptographic keys when none are configured. During exploitation:

1. Attacker crafts malicious serialized object
2. Application receives forged 'remember me' cookie
3. CookieRememberMeManager.decrypt() is invoked to process it
4. getDecryptionCipherKey() provides default insecure key
5. Insecure deserialization occurs via these methods

These functions appear in stack traces when processing malicious cookies. The patch in 1.2.5 likely enforced key configuration and removed defaults.