CVE-2020-12398

What it actually does

The client accepts a PREAUTH response from an IMAP server configured for STARTTLS and proceeds with the session in plaintext, exposing message contents and credentials in transit.

Why it matters to the business

Sensitive email content and authentication material can be read by any party on the network path, creating compliance and confidentiality risks for organizations that rely on the client.

How an attack unfolds

An attacker positions themselves to intercept or impersonate the IMAP server, returns a PREAUTH banner instead of the expected STARTTLS negotiation, and the client silently continues without encryption, allowing passive capture of all subsequent email traffic.

How to fix it

Upgrade Thunderbird to version 68.9.0 or later. Verify that STARTTLS enforcement remains enabled after the update and test connections to ensure TLS negotiation occurs before any mailbox commands.

How to confirm the fix worked

Confirm client version is at least 68.9.0, review IMAP connection logs for successful TLS handshakes on STARTTLS ports, and test against a server that deliberately sends PREAUTH to verify the client now rejects the unencrypted path.

Typical attack path

1. Attacker performs network interception or DNS spoofing against the target user's IMAP connection
2. Malicious or compromised server responds with PREAUTH to the initial greeting
3. Client skips TLS upgrade and sends credentials and mailbox data in clear text
4. Attacker records or modifies the unprotected traffic

How to detect it

Search mail client logs and network flow records for IMAP sessions on port 143 that never complete a TLS handshake after a STARTTLS command, or that show PREAUTH responses followed immediately by plaintext LOGIN or SELECT commands.

• IMAP PREAUTH response followed by unencrypted LOGIN
• STARTTLS command issued on port 143 with no subsequent TLS ClientHello
• Thunderbird version < 68.9.0 in process or package metadata

What your security team should do

• Prioritize patching all Thunderbird installations to 68.9.0+
• Audit mail server configurations to require TLS and reject PREAUTH on STARTTLS ports
• Enable network monitoring for unencrypted IMAP traffic from client systems