The vulnerability stems from insecure cryptographic practices in tracking failed logins. Magento's customer authentication subsystem would logically handle this via the Authentication model. The CWE-312 alignment suggests either cleartext storage or weak encryption. While exact pre-patch code isn't available, historical context indicates MD5 usage for lockout hashes was a common Magento flaw. The Encryptor class is included with medium confidence because its misuse (e.g., weak algorithm selection) would directly enable this vulnerability, though the exact flawed implementation isn't verifiable without patch diffs.