The provided vulnerability information describes an improper certificate validation issue (CWE-295) where Boundary's TLS certificate validation allowed crafted certificates to hijack sessions. While the root cause appears to be in certificate verification logic that didn't enforce byte-for-byte certificate matching (fixed in 0.15.0), the available data lacks specific code references, commit diffs, or function names from the HashiCorp/Boundary repository. Without concrete evidence of the exact functions handling certificate generation, storage, or validation (e.g., TLS handshake verification routines or TOFU token checks), identifying specific vulnerable functions with high confidence is not possible.