The vulnerability stems from unsanitized form data being included in error messages. The key evidence is the patch modifying Descriptor.java's newInstance method to use RedactSecretJsonInErrorMessageSanitizer when formatting error messages - this directly addresses credential leakage. The advisory also explicitly calls out RequestImpl.java as part of the vulnerable code path, though its exact vulnerable function isn't visible in the provided diff. The high confidence for Descriptor.newInstance comes from the direct code change observed; medium confidence for RequestImpl comes from advisory attribution but lack of specific pre-patch code examples.