The key evidence comes from the 2.3.11 patch notes mentioning 'more consistency in resource gatekeepers' (commit 60a045a3). Open redirects typically occur when redirect parameters (e.g., return_to, next) are not properly validated. The gatekeeper component likely handled access control checks and redirects, but allowed arbitrary URLs in redirect parameters. While the exact function isn't specified in available data, the gatekeeper's role in resource access and the patch's focus on consistency strongly suggest this component contained the vulnerable logic. Confidence is medium due to reliance on patch descriptions without direct code analysis.