The vulnerability stems from JSON parsing logic in framework-specific parsers (Flask, Webapp2, Bottle) that lacked Content-Type validation. The commit diff shows fixes in webapp2parser.py and bottleparser.py adding Content-Type checks, implying their pre-patch versions were vulnerable. The CVE title explicitly references flaskparser.py, so its JSON parsing function (likely load_json) is included despite the diff not showing it directly. All three functions allowed JSON parsing regardless of Content-Type, enabling CSRF.