MariaDB Connector/C versions 3.4.1 through 3.4.9 contain a flaw in the Zero‑Configuration SSL authentication‑switch logic. The library accepts a certificate that is trusted but fails to reject a hostname mismatch before selecting the non‑hashing mysql_clear_password authentication plugin. An attacker who can perform a man‑in‑the‑middle interception and present a valid certificate for a different hostname can cause the connector to transmit the database password in cleartext inside the TLS session, exposing sensitive credential material.

Applications that use the vulnerable Connector/C library to connect to MariaDB or MySQL databases over TLS and rely on the mysql_clear_password plugin are affected. This includes any client built against Connector/C from v3.4.1 up to, but not including, v3.4.10. Other MariaDB connectors are not impacted.

The CVSS score of 5.9 indicates medium severity. EPSS data is unavailable and the vulnerability is not listed in the CISA KEV catalog, implying a lower likelihood of exploitation. However, the attack requires network access for a man‑in‑the‑middle position and a certificate that the client will accept for a hostname mismatch, which is achievable by a skilled adversary. The primary risk is the disclosure of cleartext passwords, which compromises confidentiality of database credentials.