NPM: MySQL2: Auth Plugin Downgrade to mysql_clear_password Leaks Plaintext Credentials

NPM: MySQL2: Auth Plugin Downgrade to mysqlclearpassword Leaks Plaintext Credentials vulnerability discovered by ? in WordPress Npm mysql2 versions 3.22.0...

MySQL2: Auth Plugin Downgrade to mysql_clear_password Leaks Plaintext Credentials

Summary A rogue MySQL server or MITM can force mysql2 to send credentials in plaintext by requesting an auth switch to mysqlclearpassword. The driver complies without verifying that TLS is active. Details mysqlclearpassword is registered as a default standard plugin in lib/commands/authswitch.js...