The vulnerability arises because TLS authentication is only applied to endpoints discovered via DNS SRV records in the discoverEndpoints function, while endpoints provided via --endpoints are not authenticated. However, the provided information does not include specific code changes or function names related to processing the --endpoints flag. Without the actual patch details or code snippets, it's impossible to definitively identify the exact vulnerable functions that handle the --endpoints input without authentication. The discoverEndpoints function itself implements correct authentication but is not the source of vulnerability; the issue lies in the code path that processes --endpoints without invoking proper authentication checks, which isn't explicitly named in the available data.