The vulnerability stems from improper validation of cryptographic signatures on events. The patch introduced in commit 5bf8bc7 adds validation for both the sender's server and the event_id domain's server. The pre-patch version of _check_sigs_and_hashes in federation_base.py only checked signatures from the event's origin server (via p.origin) and used a single verification step via keyring.verify_json_objects_for_server. The post-patch code splits this into multiple checks via _check_sigs_on_pdus, explicitly validating both event_id_domain and sender_domain signatures (except for 3pid invites). The lack of event_id domain validation in the original function directly matches the CWE-347 description and the vulnerability's root cause.