The vulnerability stems from improper input validation (CWE-20) when processing form submissions. Contao's InsertTagParser is designed to replace specially formatted tags, but when applied to unvalidated user input from forms (particularly fields using array keys), it allows injection. The Form class's compilation process likely feeds user input into this parser. The workaround guidance to avoid array keys and frontend login forms aligns with these components being the injection vector. While exact code isn't available, Contao's architecture and vulnerability patterns strongly implicate these core form processing and insert tag handling mechanisms.