Is K-9 Mail susceptible to MITM attacks?
It uses the Android in-built SSL socket factory to create the connection. So yes, it's just as authenticated as accessing a secure webpage on the phone's browser.