The vulnerability centers on improper session invalidation when users are deleted in external security realms. The patch introduced a per-user seed to invalidate sessions/cookies. The key vulnerable function is the authentication processor for 'Remember me' cookies (RememberMeLoginFilter.attemptAuthentication), which lacked seed validation in pre-patch versions. This allowed attackers to maintain active sessions indefinitely using stale cookies, even after user deletion. The function's role in cookie-based authentication directly aligns with the vulnerability's mechanism described in the advisory.