The vulnerability stems from the absence of rate limiting on the POST /login endpoint. The fix commit adds a Flask-Limiter decorator (@limiter.limit) to this specific route, which was previously missing. The login handler function itself (def login()) remained otherwise unchanged, indicating the vulnerability was specifically about missing access control wrappers rather than flawed logic within the function. Supporting changes in templates and static files only implement error message differentiation between credential errors and rate limiting errors.