The vulnerability stems from the absence of a lock mechanism in the login_attempt_failed() function prior to the patch. The commit diff shows the fix introduced a resource lock and user preference cache reload to ensure atomic increments of login_failed_count. Without this lock, concurrent threads could read outdated values of the failed login counter, increment them independently, and fail to trigger the lockout threshold correctly. The function's logic to count/update failed attempts was not thread-safe, making it the clear vulnerable entry point.