The vulnerability stems from the lack of username/class validation in the cookie consumption process. The commit diff shows critical security checks were added to PersistentRememberMeHandler.php's consumeRememberMeCookie method, specifically comparing getUserIdentifier() and getClass() between the cookie data and database record. The original code (before patch) did not perform these checks, making this function the entry point for the authentication bypass. The test cases added in PersistentRememberMeHandlerTest.php also validate this scenario by checking for invalid owners/cookie values.