Does the password ever get logged or just the user name? If password, probably more serious and should be marked as security bug.
Does the password ever get logged or just the user name? If password, probably more serious and should be marked as security bug.