The vulnerability stems from the LoginHandler's post method in authentication.py, which previously used the 'next_' parameter from the request to determine the redirect location after login. The commit diff shows this parameter was removed in favor of a hardcoded default page. Security advisories and the CVE description explicitly reference this endpoint's handling of the 'next' parameter as the vulnerability source. While the GET method also used the parameter, the primary exploit vector and official fix focused on the POST handler, as demonstrated by the provided PoC and maintainer discussion.