The vulnerability was twofold:
Previously, some verification steps occurred on the user's browser (client-side), making them easy to manipulate. The patch moves these critical checks directly to the secure server. www animalpass com patched