Slawomir Jasek

The issue allows man-in-the-middle attackers to disable bidirectional authentication and obtain sensitive information via a crafted string in a response. This triggers a downgrade to simple authentication, which sends credentials in plaintext.

The issue allows man-in-the-middle attackers to bypass server certificate validation, redirect a connection, and obtain sensitive information via crafted responses, due to the client supporting anonymous ciphers by default.