The vulnerability stems from missing rate limiting in authentication flow. The patch adds the ThrottlesLogins trait to LoginController, which is Laravel's built-in mechanism for login attempt throttling. Before this fix, the controller only used AuthenticatesUsers trait without its complementary throttling functionality. The login method (inherited from AuthenticatesUsers) would not enforce any attempt limits without ThrottlesLogins, making it the vulnerable entry point. The direct correlation between adding ThrottlesLogins and the vulnerability description confirms this is the affected function.