This is my understanding from reading the OP. Lynx is a CLI browser and apparently it sends plain-auth credentials in the clear in the SNI/hostname part of the https/tls handshake. I suppose someone forgot that the authority part of a uri has a slot for both userinfo as well as host, and parsed it wrong. [0]

As far as mitigations go, I guess any of these would work: don't use Lynx; don't use SNI (???); don't use plain auth.

[0]: https://en.wikipedia.org/wiki/Uniform_Resource_Identifier#Sy...