The vulnerability stemmed from missing duplicate query parameter validation in the authentication flow. The patch introduced validateDuplicateParameters() to address this. The Verify function in token.go was vulnerable because it processed query parameters (via the 'for key, values := range queryParams' loop) without first checking for duplicates. Attackers could exploit this by submitting multiple instances of security-sensitive parameters (like X-Amz-Credential) to manipulate the authentication process. The added test case in token_test.go explicitly tests for duplicate parameter rejection, confirming this was the attack vector.