The vulnerability stems from improper validation of redirect_uri schemes. The commit shows removal of ClientValidationUtil and introduction of enhanced validation in ValidationUtil, particularly for OIDC clients. The deleted ClientValidationUtil.validate was clearly part of the flawed validation chain, while the client registration endpoint (OIDCClientRegistrationProvider) would have been the entry point using this validation. The medium confidence for the second function comes from indirect evidence in the commit's OIDCContext introduction rather than explicit vulnerable code shown.