The vulnerability stems from improper handling of the 'next' parameter in the logout functionality. While the explicit vulnerable code isn't shown in the provided diffs, the commit message explicitly references replacing Flask-Security with Flask-Security-Fork to address logout redirection vulnerabilities. The Logout.get() method in Security Monkey's codebase was the entry point for this functionality, and the dependency update (Flask-Security-Fork) contained the fix for the open redirect. This indicates the logout handler in Security Monkey's code relied on vulnerable dependency logic to process redirects.