An attacker who can control the auto-configuration account identifier in Snowflake JDBC Driver versions 4.2.0 through 4.3.3 can cause the driver to redirect a credential-bearing login request to an attacker-selected HTTPS endpoint. The driver then sends a reusable login credential to the chosen host, allowing the attacker to replay the credentials and acquire the privileges granted to that account. Successful exploitation requires the application to use jdbc:snowflake:auto without an explicit host and that the attacker has a lower-trust principal able to set the account value; ordinary JDBC URLs are unaffected. The flaw stems from improper input validation (CWE-20) and the unchecked HTTP redirection (CWE-918).

Snowflake JDBC Driver versions 4.2.0 through 4.3.3 for applications that use the jdbc:snowflake:auto connection string without an explicit host a principal with lower trust capable of setting the account value. Ordinary JDBC URLs are not affected.

The CVSS score of 5.3 indicates a medium severity, and the EPSS score of less than 1% indicates a very low probability of exploitation. The vulnerability is not listed in CISA's KEV catalog. Exploitation requires a configuration environment that allows setting the account parameter, typically through a trusted configuration file or code path. An attacker would need the ability to write or modify the connections.toml file or to run application code with elevated privilege. If achieved, the attacker can capture reusable credentials and replay them to impersonate the legitimate user. Therefore, the risk is moderate but significant for environments with weak configuration controls.