The issue is related to insufficient protection of registration data, which could allow a remote attacker to access confidential data. If an IMAP server's initial server response was invalid, the connection was not properly closed, and the code could continue attempting to authenticate. This could result in authentication credentials being exposed on an unencrypted connection, or to a machine-in-the-middle.