The vulnerability stemmed from Shopware's custom email validation regex that was replaced with PHP's built-in FILTER_VALIDATE_EMAIL in the patched version. The original regex only checked for basic email format (non-whitespace@non-whitespace.non-whitespace), which failed to account for various valid email formats and normalization scenarios. This allowed attackers to create multiple accounts with different email strings that resolve to the same address when normalized. The commit diff clearly shows this function was modified to address the vulnerability, and the CWE-754 (Improper Check for Unusual Conditions) directly maps to this insufficient validation logic.