The vulnerability stemmed from missing authorization checks in S3 token validation. The commit diff shows critical validation logic was added to validateS3AuthInfo, including checking owner != null and owner.equals(awsAccessId). Prior to this patch, these checks were absent, enabling impersonation by manipulating the owner field while having valid S3 credentials. The test modifications further confirm this was the attack vector by demonstrating proper owner setting became required for validation.