Priyankn

The `HttpGet()` function in `src/base/Http win.cpp` unconditionally passes the `INTERNET FLAG IGNORE CERT CN INVALID` flag to WinINet. This action disables hostname matching for HTTPS requests related to update metadata and crash symbols, although certificate-chain validation remains active. A network-positioned attacker possessing a Windows-trusted certificate for a domain they control can impersonate the update host. This allows the attacker to inject promotional text and a clickable URL before the update metadata is validated, and to provide a malicious archive to the `ExtractSymbols()` function.

In the RFC 9101 JWTAuthenticationRequest implementation within authlib/oauth2/rfc9101/authorization server.py, the unauthenticated and client-controlled `request uri` parameter is passed to the abstract `get request object()` function before a destination or registration policy is applied. If an integrator implements this hook as an unrestricted outbound fetch, a remote attacker with a valid public client identifier can force the authorization server to request internal, link-local, or other unintended URLs. The attacker can then distinguish the results of these fetches through timing differences and varying error responses.

When the HTML backend renders pages in a headless browser using `HTMLBackendOptions(render page=True)`, the `enable local fetch` option is not enforced. The function `HTMLDocumentBackend. get browser request block reason` allows `file:` URLs unconditionally, failing to confine local requests to the source document directory. This allows a crafted HTML file to embed arbitrary local text files (such as `.env` or credential files) into a browser-rendered page image when the `playwright` dependency is installed and the input is provided as a filesystem `Path`. This disclosure is passive, as only content rendered visibly within the page viewport is captured.