The vulnerability arises from python-tuf's use of fnmatch.fnmatch for delegation path pattern matching, which internally normalizes case differently on Windows (case-insensitive) versus POSIX systems (case-sensitive). This discrepancy leads to inconsistent authorization of target paths depending on the client's OS. Specifically, on Windows, an attacker controlling a delegation role with a path pattern differing only in case from a legitimate delegation can have their targets authorized first due to delegation ordering, violating TUF's security guarantees. The vulnerable code is in tuf/api/_payload.py in the _is_target_in_pathpattern method. The recommended fix is to replace fnmatch.fnmatch with fnmatch.fnmatchcase, which does not perform case normalization and thus behaves consistently across platforms.

The impact is a violation of the TUF specification's security guarantees on Windows clients, allowing an attacker controlling a delegation role with a case-colliding path pattern to override legitimate delegations and potentially serve unauthorized targets. This could lead to integrity violations in software update processes on affected Windows clients. The vulnerability does not affect Linux or macOS clients due to their case-sensitive path matching.

A patch is available that replaces the use of fnmatch.fnmatch with fnmatch.fnmatchcase in the python-tuf code used by ggshield. Users should upgrade to a fixed version beyond 1.51.0_1 where this change is applied. No additional mitigation is required if the patch is applied.