The vulnerability stems from improper thread context handling during concurrent authentication operations. The patches focus on adding ContextPreservingActionListener wrappers and thread context parameters to asynchronous operations. The identified functions directly handle authentication flow control (AuthenticationService), user lookup/credential caching (CachingUsernamePasswordRealm), and asynchronous callback management (ListenableFuture). These were vulnerable because they processed multiple concurrent requests without properly isolating thread contexts, allowing header/credential mixups. The patch evidence shows direct modifications to add context preservation in these specific code paths.