The vulnerability stems from RESTEasy's handling of unannotated @PathParam values in responses. When a JAX-RS resource method uses @PathParam without @Produces, RESTEasy defaults to using StringTextStar message body writers which handle text/* media types. The StringTextStar provider's writeTo() method directly writes the string to the output stream without HTML encoding. When attackers inject malicious payloads into path parameters, the lack of output encoding combined with browser interpretation of unspecified Content-Type as text/html enables XSS. The combination of missing @Produces annotation and the unescaped output in StringTextStar.writeTo creates the vulnerability vector.