PIA's "POST /v1/upload/sbom" endpoint accepts a Bearer JWT and checks its unverified "iss" claim against an issuer allowlist using Python's "urlparse" before performing OIDC discovery with "requests". Because "urlparse" and "requests"/"urllib3" parse an authority string containing a backslash (e.g. "https://attacker-host\@ci.eclipse.org/") into different hostnames, an attacker can craft an issuer that passes the allowlist check yet drives "requests" — and subsequently "urllib.request.urlopen" for JWKS retrieval — to connect to an arbitrary attacker-chosen host, port, and scheme.