The vulnerability stems from missing Content-Type: application/json headers in controller responses, which allowed browsers to misinterpret JSON payloads as HTML. This enabled XSS when user-controlled data (e.g., error messages with HTML markup) was reflected in responses. The commit patched this by adding proper headers and removing manual JSON parsing in client-side JavaScript. The affected display() methods in front controllers handled user input and returned responses vulnerable to HTML injection due to the missing headers.