OfflineIMAP versions before 8.0.3 accept the server's STARTTLS capability before authenticating the user. This trust flaw allows an attacker who can act as a man‑in‑the‑middle or spoof the server to force the client to downgrade the connection, taking over and reading the plaintext login credentials. The impact is loss of confidentiality for stored email account credentials, which could lead to full account compromise and unauthorized access to the user's mail data.

The product affected is OfflineIMAP, an open source IMAP client. Versions older than 8.0.3, including all releases prior to and including 8.0.2, are vulnerable. The vulnerability appears in all distributions of OfflineIMAP that advertise STARTTLS capability during the initial handshake.

The CVSS score of 6.5 indicates moderate severity. Since the EPSS score is not provided, the current exploit likelihood cannot be quantified precisely, but the flaw enables a straightforward MITM attack against any connection over an untrusted network. The vulnerability is not listed in the CISA KEV catalog, suggesting no widespread commercial exploitation is documented yet. Attackers would need network access to intercept traffic between the client and the mail server; once achieved, they can impersonate the server and capture credentials before encryption is established.