WS-2026-0048

node-mysql2 accepts a server-initiated switch to the mysqlclearpassword authentication plugin without requiring explicit opt-in, so the client transmits the password in plaintext. A malicious or DNS-hijacked server can request cleartext authentication and capture credentials even when the...