mysql_common.c:gw_send_change_user_to_backend creates new authentication message which is to be sent to backend. GWBUG type flags were not copied from original GWBUF to new one. Thus the information that this is a session command was lost and it was processed in a wrong way. Especially replies were all routed back to client which caused misbehavior.