diff --git a/CHANGES.txt b/CHANGES.txt
index 2f31f4a2e2..dd60eb447e 100644
--- a/CHANGES.txt
+++ b/CHANGES.txt
@@ -1,4 +1,5 @@
 4.1.6
+ * Support legacy plain_text_auth section in credentials file removed unintentionally (CASSANDRA-19498)
 Merged from 4.0:
  * Add timeout specifically for bootstrapping nodes (CASSANDRA-15439)
  * Bring Redhat packge dirs/ownership/perms in line with Debian package (CASSANDRA-19565)
diff --git a/bin/cqlsh.py b/bin/cqlsh.py
index 328393eb58..286a5c0949 100755
--- a/bin/cqlsh.py
+++ b/bin/cqlsh.py
@@ -2183,7 +2183,7 @@ def read_options(cmdlineargs, environment):
         credentials.read(options.credentials)
 
         # use the username from credentials file but fallback to cqlshrc if username is absent from the command line parameters
-        options.username = username_from_cqlshrc
+        options.username = option_with_default(credentials.get, 'plain_text_auth', 'username', username_from_cqlshrc)
 
     if not options.password:
         rawcredentials = configparser.RawConfigParser()
@@ -2191,7 +2191,6 @@ def read_options(cmdlineargs, environment):
 
         # handling password in the same way as username, priority cli > credentials > cqlshrc
         options.password = option_with_default(rawcredentials.get, 'plain_text_auth', 'password', password_from_cqlshrc)
-        options.password = password_from_cqlshrc
     elif not options.insecure_password_without_warning:
         print("\nWarning: Using a password on the command line interface can be insecure."
               "\nRecommendation: use the credentials file to securely provide the password.\n", file=sys.stderr)
diff --git a/conf/credentials.sample b/conf/credentials.sample
index 23d0beb71b..99f0832689 100644
--- a/conf/credentials.sample
+++ b/conf/credentials.sample
@@ -17,7 +17,18 @@
 ;
 ; Sample ~/.cassandra/credentials file.
 ;
-; Please ensure this file is owned by the user and is not readable by group and other users
+; The section name must match the classname from the cqlshrc file
+; For example, if cqlshrc contains settings
+;
+; [auth_provider]
+; module = cassandra.auth
+; classname = PlainTextAuthProvider
+;
+; then the credentials file should contain a [PlainTextAuthProvider] section with the username and password parameters, as indicated in this example.
+;
+; For backward compatibility, it is also possible to specify [plain_text_auth] as a header.
+;
+; Please ensure this file is owned by the user and is not readable by group and other users.
 
 [PlainTextAuthProvider]
 ; username = fred
diff --git a/doc/modules/cassandra/pages/tools/cqlsh.adoc b/doc/modules/cassandra/pages/tools/cqlsh.adoc
index 8050ee5df0..ba9d36e703 100644
--- a/doc/modules/cassandra/pages/tools/cqlsh.adoc
+++ b/doc/modules/cassandra/pages/tools/cqlsh.adoc
@@ -46,6 +46,16 @@ Example config values and documentation can be found in the
 You can also view the latest version of the
 https://github.com/apache/cassandra/blob/trunk/conf/cqlshrc.sample[cqlshrc file online].
 
+[[credentials]]
+== credentials
+
+The credentials file contains a user-name and a password for cqlsh.
+A user-name and a password must be located in a section whose name matches the classname from the `[auth_provider]` section of the cqlshrc file.
+The credentials file must be owned by the user and no one else has permission to read the file.
+
+Example config values and documentation can be found in the
+`conf/credentials.sample` file of a tarball installation.
+
 [[cql_history]]
 == cql history