The vulnerability stemmed from how getIPAddress() handled proxy IP validation. Pre-patch versions allowed $proxyIPs to be configured as a string/comma-list, which led to insufficient verification of client IP headers. The method checked multiple headers (X-Forwarded-For, Client-IP, etc.) without properly validating whether the connecting proxy itself was trusted, enabling IP spoofing if the server was behind a reverse proxy. The commit 5ca8c99 fundamentally changed $proxyIPs to require explicit proxy-IP-to-header mappings, and added validation checks that were previously missing.