Cleartext password disclosure to MitM via mysql_clear_password

When an application connects with ssl: true (certificate verification ON) and a password, but does not pin a CA, the connector intentionally accepts an untrusted/self-signed server certificate at the TLS layer and instead proves the server's identity afterwards by binding the certificate fingerprint into the authentication exchange

This delayed fingerprint/identity guard result in a Error thrown, but still might have been send to rogue server.