The vulnerability stemmed from recursive token expansion without depth control. The Parser.processToken() method handled token replacement recursively but lacked a recursion limit prior to the patch, enabling infinite recursion. Additionally, AbstractChangesSinceMacro and ChangesSinceLastBuildMacro's evaluate() methods processed user-controllable format/path parameters through TokenMacro.expandAll() without limiting recursion depth, creating secondary expansion vectors. The commit introduced a MAX_RECURSION_LEVEL check in Parser and removed nested expansion capabilities from these macros, confirming their role in the vulnerability.