Plain texst credentials via RTSP setup packet (kali linux)
Hardware / Version info
Linux kernal 5.16.0-kali7-amd64
Kali Persistant live usb enviorment
VLC version 3.0.17.4 Vetinari
lenovo Thinkpad
Steps to produce the problem
Start up a RTSP stream in any format. (OBS)
media->open network stream -> fill in credentials and location -> play
Watch the incoming or outgoing packets through a packet sniffer (wireshark)
See that in the setup packet as part of the identifier the username and password are sent over plain tekst in the packet.
Additional experimenting
I have tried this out with different version of VLC on different devises.
It does not seem to happen with a Windows / Android version of VLC on this device or different ones.
What software is streaming (or if the target is actually streaming) does also not seam to matter for this bug.
Edit: Tried ubuntu 5.15.0.25 vlc 3.0.16 Vetinari it doesn't seem to have this issue