The python-tuf client has a platform-dependent vulnerability in its delegation path matching logic. On Windows, path pattern matching is case-insensitive due to the use of fnmatch.fnmatch, which normalizes case, whereas on POSIX systems it is case-sensitive. This discrepancy violates the TUF specification and can allow an attacker controlling a delegated role with a case-colliding path pattern to influence target authorization on Windows clients.