The vulnerability manifests in GetAuthDetails.html.php where the 'token' parameter is retrieved from user input ($_GET) and directly output in HTML context without proper sanitization. The GitHub issue #129 explicitly shows the vulnerable pattern: user-controlled token parameter is embedded in page output without escaping, creating a classic reflected XSS vulnerability. While no named functions are referenced, the inline PHP code handling parameter output constitutes the vulnerable code path.