The vulnerability stems from improper credential handling during cross-domain redirects. While exact patch details are unavailable, the CVE description indicates the core issue is in redirect handling logic. These functions are fundamental to Reactor Netty's redirect mechanism and would be responsible for propagating headers. The vulnerability would manifest in these functions when they forward Authorization headers to new domains without validation. Patches likely added domain comparison checks in these areas to strip credentials when domains change.