The vulnerability is an authorization fault caused by the MariaDB "GRANT PROXY" statement treating an empty IDENTIFIED password as if no authentication had been specified. This logic flaw allows an attacker who can specify another user's account name to reset that account's password. The flaw is a classic grantor privilege check error (CWE-620) combined with improper use of a proxy privilege (CWE-863), resulting in unauthorized credential creation. The impacted functionality is confined to the GRANT PROXY command, and the attacker gains full control over the victim account’s password, potentially leading to further privilege escalation or denial of service.

All affected MariaDB server versions before the patch are: 10.6.x up to 10.6.28, 10.11.x up to 10.11.19, 11.4.x up to 11.4.13, 11.8.x up to 11.8.9, 12.3.x up to 12.3.3, and 13.0.x up to 13.0.2. These releases were shipped with the faulty GRANT PROXY handling and are missing the necessary privilege validation.

The CVSS score of 8.8 indicates a high severity vulnerability. Although EPSS is not available, the lack of a KEV listing suggests no current widespread exploitation, but the potentially powerful impact for a low‑privileged attacker cannot be underestimated. A typical attack scenario requires the attacker to run a GRANT PROXY statement with an empty IDENTIFIED clause against a chosen account; this usually presupposes some local database access or a compromised user with permission to execute GRANT PROXY. In environments where GRANT PROXY is available to non‑privileged users, the attack vector could be both local and remote, depending on how the database interfaces are exposed. The vulnerability bypasses normal authentication, allowing the attacker to set an arbitrary password for any target account without needing the original credentials.