In the affected MariaDB Connector/Node.js implementations, credentials are transmitted in cleartext before the SSL/TLS server certificate is fully verified. This occurs when the connector is configured with `ssl: true` but no pinned CA or server certificate is supplied. The connector first sends the password when mysql_clear_password is selected as the authentication plugin, and this occurs before the post‑TLS identity check completes. As a result, an attacker performing a man‑in‑the‑middle can receive the cleartext password, capture it, and later use the same credentials to authenticate to the database. The weakness is a classic disclosure of sensitive information (CWE‑295) and inadequate protection of credentials (CWE‑522). Attackers may not gain code execution but can compromise account access, leading to potential data theft or further exploitation.

The vulnerability affects the MariaDB Connector/Node.js library for Node.js applications. Versions prior to 3.3.3, 3.4.6, and 3.5.3 are impacted. The vendor is MariaDB Corporation, product name Connector/Node.js. Any Node.js application using this connector will be susceptible until the library is upgraded to a fixed release.

The CVSS score of 7.5 indicates a high vulnerability severity. The exploit requires an active network attacker capable of intercepting traffic between the Node.js application and the MariaDB or MySQL server. If the connection occurs over an unsecured network or a compromised LAN, the attacker can present a forged self‑signed certificate, capture the password, and later authenticate to the database until the connection is rejected. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting that while the risk is significant, there is no current evidence of widespread exploitation.