The vulnerability is explicitly documented in multiple sources (CVE, GHSA, Jenkins advisory) as residing in the doFillTowerCredentialsIdItems method of the TowerInstallationDescriptor class. This method handles credential enumeration functionality and was missing the required permission validation in vulnerable versions. The function signature follows Java inner class conventions (TowerInstallation$TowerInstallationDescriptor) and matches the pattern of Jenkins descriptor methods used for form field population.