The vulnerability stems from the insecure use of permit! in the updated_ajax method, as shown in the pre-patch code diff. This method allowed mass assignment of any parameters under :password, including unauthorized attributes. The GitHub patch explicitly replaces permit! with a restricted permit(%i[password password_confirmation]) and adds parameter validation, confirming this was the vulnerable entry point. The CWE-915 mapping and advisory descriptions directly reference this insecure parameter handling pattern.