The vulnerability stems from a hardcoded JWT secret key in the application.yml configuration file (lin.cms.token-secret), not from specific code functions. While JWT-related functions would inherently be vulnerable due to using this static secret, no specific functions are explicitly mentioned in the provided vulnerability details. The root cause is the exposure through a misconfigured resource (CWE-668) rather than vulnerable code logic. The advisory directly references the configuration line but doesn't identify concrete functions in the codebase, making function-level attribution speculative without additional code context.