Executive brief
OfflineIMAP is a tool used to synchronize email between local storage and remote mail servers. A security flaw allows an attacker positioned on the network to trick the software into sending account passwords in plain text, even when encrypted connections are requested. This could lead to the theft of email credentials and unauthorized access to user mailboxes.
Technical details
OfflineIMAP versions prior to 8.0.3 fail to enforce STARTTLS even when configured to use it. The application checks the server's capability list and, if the STARTTLS keyword is missing, silently falls back to a cleartext connection instead of aborting. A man-in-the-middle (MITM) attacker can exploit this by stripping the STARTTLS capability from the server's initial response. This allows the attacker to intercept the subsequent authentication exchange and extract user credentials in cleartext. The issue was addressed in version 8.0.3 by ensuring the client attempts STARTTLS regardless of the advertised capabilities if the user has enabled it.
Affected products
- OfflineIMAP OfflineIMAP < 8.0.3
Timeline
- 2020-05-29: disclosed: Initial issue reported on GitHub
- 2026-06-08: patched: Version 8.0.3 released on PyPI
- 2026-06-08: advisory: CVE-2020-37248 published