{"record":{"id":"bd3e6171c5d3e0f7","repo":"apache/cassandra","slug":"credential-format-error-username-or-password-is-e","errorCode":null,"errorMessage":"Credential format error: username or password is empty or contains NUL(\\0) character","messagePattern":"Credential format error: username or password is empty or contains NUL\\(\\\\0\\) character","errorType":"exception","errorClass":"AuthenticationException","httpStatus":null,"severity":"error","filePath":"src/java/org/apache/cassandra/auth/PasswordAuthenticator.java","lineNumber":346,"sourceCode":"         * @throws org.apache.cassandra.exceptions.AuthenticationException if either the\n         *         authnId or password is null\n         */\n        private void decodeCredentials(byte[] bytes) throws AuthenticationException\n        {\n            logger.trace(\"Decoding credentials from client token\");\n            byte[] user = null;\n            byte[] pass = null;\n            int end = bytes.length;\n            for (int i = bytes.length - 1; i >= 0; i--)\n            {\n                if (bytes[i] == NUL)\n                {\n                    if (pass == null)\n                        pass = Arrays.copyOfRange(bytes, i + 1, end);\n                    else if (user == null)\n                        user = Arrays.copyOfRange(bytes, i + 1, end);\n                    else\n                        throw new AuthenticationException(\"Credential format error: username or password is empty or contains NUL(\\\\0) character\");\n\n                    end = i;\n                }\n            }\n\n            if (pass == null || pass.length == 0)\n                throw new AuthenticationException(\"Password must not be null\");\n            if (user == null || user.length == 0)\n                throw new AuthenticationException(\"Authentication ID must not be null\");\n\n            username = new String(user, StandardCharsets.UTF_8);\n            password = new String(pass, StandardCharsets.UTF_8);\n        }\n    }\n\n    public static class CredentialsCache extends AuthCache<String, String> implements CredentialsCacheMBean\n    {\n        private CredentialsCache(PasswordAuthenticator authenticator)","sourceCodeStart":328,"sourceCodeEnd":364,"githubUrl":"https://github.com/apache/cassandra/blob/88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1/src/java/org/apache/cassandra/auth/PasswordAuthenticator.java#L328-L364","documentation":"PasswordAuthenticator's PLAIN SASL token is expected as authzid NUL authcid NUL password. decodeCredentials() scans the token for NUL separators; if it finds more segments than allowed (i.e. a NUL embedded in a credential), the structure is invalid and AuthenticationException is thrown.","triggerScenarios":"Sending an AuthResponse byte token containing more than two NUL separators, e.g. a username or password that itself contains a NUL (\\0) character, or a malformed third segment.","commonSituations":"Clients that naively string-concatenate credentials without escaping; corrupted or hand-crafted auth tokens; drivers mis-encoding the PLAIN message; security scanners sending malformed SASL payloads.","solutions":["Remove NUL characters from the username/password before constructing the PLAIN token","Encode the token as exactly: UTF8(authzid) 0x00 UTF8(authcid) 0x00 UTF8(password)","Check the driver's SASL/PLAIN credential encoding helper rather than building bytes manually"],"exampleFix":"// before\nString token = authzid + \"\\0\" + userWithNul + \"\\0\" + pass;\n// after\nString cleanUser = userWithNul.replace(\"\\0\", \"\");\nString token = authzid + \"\\0\" + cleanUser + \"\\0\" + pass;","handlingStrategy":"validation","validationCode":"if (user.indexOf('\\0') >= 0 || pass.indexOf('\\0') >= 0) throw new IllegalArgumentException(\"credentials must not contain NUL\");","typeGuard":"boolean isPlainSafe(String s) { return s != null && s.indexOf('\\0') < 0; }","tryCatchPattern":"try { session.connect(authInfo); } catch (AuthenticationException e) { if (e.getMessage().contains(\"NUL\")) sanitizeAndRetry(); }","preventionTips":["Sanitize credentials against NUL before building SASL PLAIN tokens","Use the driver's SASL/plain encoder instead of manual byte construction","Fuzz-test your auth token builder for separator injection"],"tags":["authentication","sasl","encoding"],"backgroundTag":"invalid-argument-format","analyzedSha":"88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1","analyzedAt":"2026-09-10T07:29:22.284Z","contentChangedAt":"2026-09-10T07:29:22.284Z","schemaVersion":2},"datasetVersion":"2026-09-14T16:17:12.679Z"}