The vulnerability stems from the missing Jenkins.ADMINISTER permission check in the doValidateUserNamePassword method, as shown in the commit diff where this check was added post-fix. The method also lacked @RequirePOST annotations to prevent CSRF exploitation. The CVE description explicitly identifies this method as the attack vector, and the patch adds both permission checks and HTTP method restrictions to mitigate the issue.