Improper input validation in ASP.NET Core allows an unauthorized attacker to bypass a security feature over a network. Specifically, the `PathString.StartsWithSegments()` function can mishandle percent-encoded backslashes, which may permit authorization checks to match an unintended path.