The vulnerability stems from missing impersonation checks in SASL authorization handlers. The patches add 'impersonationAllowed' flags to ServerCallbackHandlers across authentication mechanisms (Kerberos/Digest/Plain). The handleAuthorizeCallback methods in these classes previously processed authorization requests without validating if the server configuration permitted impersonation. During exploitation, these functions would appear in stack traces as they directly handle user authentication/authorization and would process malicious impersonation attempts.