The vulnerability stems from SpEL evaluation of the response_type parameter during OAuth approval page rendering. The WhitelabelApprovalEndpoint's getAccessConfirmation method was responsible for exposing the raw authorizationRequest (including untrusted response_type) to Thymeleaf/FreeMarker templates. The security patch modifies this method to sanitize the response_type input, indicating this was the injection point. During exploitation, the stack trace would show this controller method processing the malicious request before SpEL evaluation occurs in the view template.