Changes reported in operations but only securityScheme changed

I am using

    testImplementation("org.openapitools.openapidiff:openapi-diff-core:2.1.6") {
        exclude(group = "io.swagger.core.v3", module = "swagger-core")
        exclude(group = "io.swagger.core.v3", module = "swagger-models")
        exclude(group = "io.swagger.core.v3", module = "swagger-annotations")
    }

Given the two API docs to compare where the only change is in authorizationUrl ('' vs. 'some_value') and tokenUrl ('' vs. 'some_value').

components:
  securitySchemes:
    OAuth2:
      bearerFormat: JWT
      flows:
        authorizationCode:
          authorizationUrl: ''
          tokenUrl: ''
      in: header
      scheme: bearer
      type: oauth2
info:
  title: Company API
  version: V0
openapi: 3.1.0
paths:
  /users:
    post:
      operationId: createUser
      responses:
        "201":
          description: Created
      security:
      - OAuth2: []
servers:
- description: Default Server URL
  url: /api/

components:
  securitySchemes:
    OAuth2:
      bearerFormat: JWT
      flows:
        authorizationCode:
          authorizationUrl: 'some_value'
          tokenUrl: 'some_value'
      in: header
      scheme: bearer
      type: oauth2
info:
  title: Company API
  version: V0
openapi: 3.1.0
paths:
  /users:
    post:
      operationId: createUser
      responses:
        "201":
          description: Created
      security:
      - OAuth2: []
servers:
- description: Default Server URL
  url: /api/

The resulting error message is misleading as the issue is not directly related to any concrete endpoint. This took me quite a while to narrow this down to this difference.

So it would be nice to have a more suitable error message.

org.opentest4j.AssertionFailedError: [### Company API (v V0)
---

#### What's Changed
---

##### `POST` /users


#### Result
---

API changes broke backward compatibility

] 

Start by reproducing the report with the two OpenAPI 3.1 documents shown and the openapi-diff-core 2.1.6 dependency. Trace how changes to the OAuth2 securityScheme's authorizationUrl and tokenUrl are assigned to POST /users, then update the reported change location and verify the resulting message identifies the security-scheme change.