The vulnerability stems from unsafe deserialization during cookie/header decryption. The core issue is in Encrypter::decrypt which by default performed unserialize() on decrypted data. The middleware components (EncryptCookies and VerifyCsrfToken) called this method without proper serialization controls, particularly for XSRF tokens. The patch added explicit serialization flags (false for XSRF-TOKEN) to prevent unserialization of untrusted data. The vulnerable functions are those that handled decryption of user-controlled tokens without these safeguards, enabling PHP object injection when the app key was known.