PAM (dialog) authentication must require a secure connection

The mysql_clear_password plugin is gated behind a secure connection , so the driver refuses to send the password in clear text over plain TCP. The sibling PAM plugin SendPamAuthPacketFactory (server-side plugin name dialog) does not override that flag and inherits the default false.

A hostile or man-in-the-middle server can issue an Authentication Switch Request for plugin dialog over plain TCP and the driver responds with the user's password in clear text. With the default configuration (sslMode=DISABLE, restrictedAuth=null) this is reachable with no non-default options.

Fix:

Treat PAM exactly like mysql_clear_password: it may only run over a secure transport.

SendPamAuthPacketFactory overrides the secure-required flag to true.
The auth dispatcher permits a secure-required plugin only when the connection is TLS or a local unix socket, (the pre-existing check already blocks any non-MitM-proof plugin when server identity relies solely on self-signed-certificate fingerprint validation). Net effect: PAM is allowed over TLS or unix socket, and rejected over plain TCP or fingerprint-only connections.

thanks fg0x0 for the report