The vulnerability was due to a weakness in Facebook's "View Activity Log" feature, which did not properly validate user input. This allowed an attacker to inject malicious code and access the activity logs of other users.