Man-in-the-Middle (MitM)

github.com/golang/go is vulnerable to man-in-the-middle (MitM) attack. A malicious user can set up a MitM SMTP server that doesn’t advertise STARTTLS and advertises that PLAIN authentication can be used. By doing this, smtp.PlainAuth will send the username and password will be sent to the server instead of the credentials secured with TLS. This is caused by a flaw where smtp.PlainAuth blindly trusts the server despite the PLAIN authentication method only intended to be used for local connections.