The vulnerability in MariaDB Connector/J allows a server to intentionally trigger the driver to transmit user passwords in cleartext. Prior to versions 2.7.14, 3.3.5, 3.4.3, and 3.5.9, the driver’s PAM dialog authentication helper does not enforce a secure transport. When a client connects with sslMode set to DISABLE and restrictedAuth set to null (the default), a malicious or compromised server can send an Authentication Switch Request that causes the driver to send the password in plain TCP. This flaw represents a cleartext transmission of sensitive information (CWE‑319) and insufficiently protected credentials (CWE‑522), potentially enabling credential theft without granting further system access.

MariaDB Corporation’s MariaDB Connector/J is affected in all branches older than the following releases: 2.7.14, 3.3.5, 3.4.3, and 3.5.9. The product is used by Java applications that connect to MariaDB or MySQL databases and relies on the driver’s default authentication mechanisms.

The CVSS score of 5.9 indicates a moderate severity. Because the flaw is triggered by a server‑initiated authentication switch and requires the client to be configured with sslMode=DISABLE, the practical exploitation likelihood depends on the attacker’s ability to act as a man‑in‑the‑middle or compromise the database server. The EPSS score is unavailable and the vulnerability is not listed in the CISA KEV catalog, suggesting no widespread large‑scale exploitation yet. Still, any environment that permits unencrypted connections and uses the default dialog authentication poses a credential disclosure risk that should be addressed promptly.